Malware-Evasion

KO | EN

gitlite — search

#javascript #hacktoberfest #react #android #rust #linux #docker #java #cli #kubernetes #vue #security #openai #mcp

Malware-Evasion

(★ 9)

How malware implements anti–reverse engineering techniques such as sandbox and VM evasion, anti-debugging, and memory integrity checks.

Malware-Evasion Latest Version Download

Download Latest Version (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# Windows Malware Evasion Techniques

![PoC screenshot](https://github.com/28Zaaky/Malware_Evasion_PoC/blob/main/Capture%20d'écran%202025-11-06%20233217.png)

> ⚠️ **Educational & Defensive Research Only**  
> This repository contains a *theoretical* and *educational* proof-of-concept (PoC) designed to help researchers and defenders understand how malware may attempt to detect sandbox or debugger environments.  
> It is **not intended for offensive or malicious use**. Never execute this code outside an isolated, authorized, and fully controlled research environment.

---

## Overview

This project demonstrates, **for research and awareness purposes only**, how certain malware families may attempt to detect virtualized or instrumented environments.

The code illustrates several *common detection categories* observed in real-world samples, such as:

- Environment fingerprinting through system information (CPU count, RAM)  
- Virtual machine artifact lookup (driver or hardware vendor/product strings)  
- Storage descriptor inspection via `DeviceIoControl`  
- Anti-debugging checks using Windows APIs (`IsDebuggerPresent`, `CheckRemoteDebuggerPresent`)  
- Process Environment Block (PEB) flag inspection  
- Memory integrity verification and breakpoint / checksum scanning

---

## File / Function mapping (high-level)

| Function / Area | Purpose (educational) |
|---|---|
| `SandboxCheck()` | Queries basic system info (CPU cores, RAM) to illustrate simple environment fingerprinting. |
| `CheckVmFiles()` | Looks for common VM driver filenames to demonstrate artifact detection. |
| `CheckVmHardware()` | Uses `DeviceIoControl` to obtain storage descriptors (vendor/product strings) for hardware-based checks. |
| `CheckDbgUsingIsDebuggerPresent()` | Example of a direct debugger API check (`IsDebuggerPresent`). |
| `CheckDbgUsingPEB()` | Illustrates reading the PEB to inspect `NtGlobalFlag`. |
| `CheckDbgUsingCheckRemoteDebuggerPresent()` | Secondary debugger detection via `CheckRemoteDebuggerPresent`. |
| `CheckBreakpUsingChecksum()` | Demonstrates a checksum/scan concept to detect breakpoints or in-memory patches. |

---

## Further reading

- *Practical Malware Analysis* — Michael Sikorski & Andrew Honig  
- *The Art of Memory Forensics* — Ligh, Case, Levy, et al.  
- MITRE ATT&CK:  
  - [T1497.001 — Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497/001/)  
  - [T1622 — Debugger Evasion](https://attack.mitre.org/techniques/T1622/)

---

## Contact

- Contact: `28zaakypro[.]proton[.]me`

Malware-Evasion

Malware-Evasion Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Malware-Evasion

Malware-Evasion Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Download README