Pafish

أداة Pafish هي كاشف لصناديق الحماية (Sandbox) المضادة للتحليل ومختبر لبيئات المحاكاة الافتراضية. تعمل كأداة تشخيصية لتحديد ما إذا كان النظام يعمل داخل جهاز افتراضي أو صندوق حماية لتحليل البرمجيات الخبيثة من خلال تنفيذ تقنيات مضادة للتحليل شائعة.

تتحقق الأداة من فعالية طرق التهرب المختلفة وتدعم البحث في كشف صناديق الحماية. تختبر ما إذا كان يمكن التعرف على النظام المستهدف كبيئة افتراضية للمساعدة في تحسين خفاء بيئات تحليل البرمجيات الخبيثة.

يتم تحقيق الكشف من خلال مجموعة متنوعة من الفحوصات السلوكية، بما في ذلك تحليل آثار العتاد، وتصفية عنوان MAC، وبصمات مفاتيح التسجيل (Registry-key). يستخدم الجناح أيضاً الكشف القائم على التعليمات، وتحليل التنفيذ القائم على التوقيت، ومسح البيئة القائم على العمليات لتحديد مؤشرات المحاكاة الافتراضية.

Features

Virtual Machine Detection - Provides a comprehensive suite to identify if a system is running within a virtual machine.
MAC Address Lookups - Identifies virtualization providers by performing manufacturer lookups on network interface MAC addresses.
Hardware Artifact Analysis - Implements hardware artifact checks to identify patterns typical of virtual machine drivers.
Instruction-Based VM Detection - Executes specific CPU instructions to detect differences between physical hardware and virtualized environments.
Process-Based Environment Scanning - Searches for background processes and services characteristic of malware analysis tools.
Registry-Key Based Fingerprinting - Checks for the presence of system registry keys associated with virtualization software.
Anti-Analysis Technique Development - Validates the effectiveness of evasion methods used to hide software from security researchers.
Sandbox Detectors - Acts as a testing suite that identifies malware analysis environments through behavioral checks.
Analysis Tool Detection - Employs mechanisms to identify the presence of system monitors and virtual machines to avoid analysis.
Malware Evasion Research - Tests system detectability to help improve the stealth of malware analysis environments.
Virtualization Detection - Implements various techniques to determine if a process is executing within a virtual machine or sandbox.
Sandbox Detection - Analyzes the specific methods and artifacts used by software to recognize automated analysis environments.
Timing-Based Detection - Measures operation execution time to detect latency introduced by hypervisor emulation.
Virtualization Environment Testers - Serves as a diagnostic utility for verifying whether a target system can detect virtualization indicators.
Analysis Frameworks - Demonstration tool for detecting sandboxes and analysis environments.
Digital Forensics - Testing tool to detect virtualized malware analysis environments.
Malware Analysis - Testing tool to detect virtualized malware analysis environments.

سجل النجوم

a0rtegapafishArchived

Name: a0rtega/pafish
Author: a0rtega

View on GitHub

3,920 نجوم494 تفرعاتCGPL-3.05 مشاهدات

Pafish

Features

Virtual Machine Detection - Provides a comprehensive suite to identify if a system is running within a virtual machine.
MAC Address Lookups - Identifies virtualization providers by performing manufacturer lookups on network interface MAC addresses.
Hardware Artifact Analysis - Implements hardware artifact checks to identify patterns typical of virtual machine drivers.
Instruction-Based VM Detection - Executes specific CPU instructions to detect differences between physical hardware and virtualized environments.
Process-Based Environment Scanning - Searches for background processes and services characteristic of malware analysis tools.
Registry-Key Based Fingerprinting - Checks for the presence of system registry keys associated with virtualization software.
Anti-Analysis Technique Development - Validates the effectiveness of evasion methods used to hide software from security researchers.
Sandbox Detectors - Acts as a testing suite that identifies malware analysis environments through behavioral checks.
Analysis Tool Detection - Employs mechanisms to identify the presence of system monitors and virtual machines to avoid analysis.
Malware Evasion Research - Tests system detectability to help improve the stealth of malware analysis environments.
Virtualization Detection - Implements various techniques to determine if a process is executing within a virtual machine or sandbox.
Sandbox Detection - Analyzes the specific methods and artifacts used by software to recognize automated analysis environments.
Timing-Based Detection - Measures operation execution time to detect latency introduced by hypervisor emulation.
Virtualization Environment Testers - Serves as a diagnostic utility for verifying whether a target system can detect virtualization indicators.
Analysis Frameworks - Demonstration tool for detecting sandboxes and analysis environments.
Digital Forensics - Testing tool to detect virtualized malware analysis environments.
Malware Analysis - Testing tool to detect virtualized malware analysis environments.

بدائل مفتوحة المصدر لـ Pafish

مشاريع مفتوحة المصدر مشابهة، مرتبة حسب عدد الميزات المشتركة مع Pafish.

lordnoteworthy/al-khaser
LordNoteworthy/al-khaser
7,001عرض على GitHub
Al-Khaser is a research project focused on the development of anti-analysis and evasion techniques to resist reverse engineering. It provides implementations for detecting and evading virtual machines, sandboxes, and debuggers to prevent software analysis. The project implements control flow obfuscation through anti-disassembly methods and utilizes dynamic API resolution to bypass static import tables. It further hinders forensic analysis by manipulating memory headers to prevent process dumps and utilizing remote code injection to execute logic in external processes. The capability surface
C++
عرض على GitHub7,001
yara-rules/rules
Yara-Rules/rules
4,712عرض على GitHub
This project is a community-curated repository of YARA rules used to detect malware, webshells, and other malicious patterns in files. It serves as a dataset of signatures for identifying known malware families, software packers, and threat intelligence indicators. The collection provides specialized detection capabilities for identifying exploit kits and anti-analysis evasion techniques, such as anti-debugging and anti-virtualization methods. It also includes signatures for cryptographic algorithm detection and the identification of unauthorized remote administration tools on servers. The r
YARA
عرض على GitHub4,712
ufrisk/memprocfs
ufrisk/MemProcFS
4,202عرض على GitHub
MemProcFS is a volatile memory analysis tool and cross-platform memory acquisition system. It functions as a memory forensic virtual file system, mapping physical memory and kernel objects into a virtual directory structure that allows users to analyze system artifacts using standard file system tools. The project distinguishes itself by providing a virtual file system for memory forensics, enabling the browsing and querying of physical memory as read-only files and folders. It also incorporates a Yara-based memory scanner to identify malware signatures and injected code within physical memor
C
عرض على GitHub4,202
malwaredllc/byob
malwaredllc/byob
9,478عرض على GitHub
This project is a post-exploitation framework and command and control platform designed for security research and penetration testing. It functions as a remote access tool consisting of a central command server and encrypted executable payloads that establish reverse shell connections. The system utilizes a web-based dashboard for multi-client administration, allowing for remote host monitoring and direct shell access through an in-browser terminal. It generates cross-platform, encrypted binaries that employ a multi-stage delivery chain and a key exchange mechanism to secure communications.
Python
عرض على GitHub9,478

عرض جميع البدائل الـ 30 لـ Pafish

الأسئلة الشائعة

ما هي وظيفة a0rtega/pafish؟

ما هي الميزات الرئيسية لـ a0rtega/pafish؟

الميزات الرئيسية لـ a0rtega/pafish هي: Virtual Machine Detection, MAC Address Lookups, Hardware Artifact Analysis, Instruction-Based VM Detection, Process-Based Environment Scanning, Registry-Key Based Fingerprinting, Anti-Analysis Technique Development, Sandbox Detectors.

ما هي البدائل مفتوحة المصدر لـ a0rtega/pafish؟

تشمل البدائل مفتوحة المصدر لـ a0rtega/pafish: lordnoteworthy/al-khaser — Al-Khaser is a research project focused on the development of anti-analysis and evasion techniques to resist reverse… yara-rules/rules — This project is a community-curated repository of YARA rules used to detect malware, webshells, and other malicious… ufrisk/memprocfs — MemProcFS is a volatile memory analysis tool and cross-platform memory acquisition system. It functions as a memory… malwaredllc/byob — This project is a post-exploitation framework and command and control platform designed for security research and… hasherezade/pe-sieve — pe-sieve is a set of diagnostic tools for scanning Windows process memory to identify malicious implants, shellcode,… nationalsecurityagency/ghidra — Ghidra is a software reverse engineering suite designed to analyze compiled binaries and reconstruct program logic…

Pafish

Features

سجل النجوم

Pafish

Features

بدائل مفتوحة المصدر لـ Pafish

LordNoteworthy/al-khaser

Yara-Rules/rules

ufrisk/MemProcFS

malwaredllc/byob

الأسئلة الشائعة

سجل النجوم

بدائل مفتوحة المصدر لـ Pafish

LordNoteworthy/al-khaser

Yara-Rules/rules

ufrisk/MemProcFS

malwaredllc/byob

الأسئلة الشائعة