Published on April 25th, 2016 | by MaxiSoler0
Sems Anti-Sandbox and Anti-Virtual Machine Tool v1.0
sems is a tool which is created to help malware researchers by checking their environments for the signatures of any virtualization techniques, malware sandbox tools or well know malware analysis tools. sems is using the same techniques and looking for the same footprints that evasive malwares do in order to detect if it is running in a controlled environment. So it is useful for malware researchers to check if the analysis environment is inevasible.
How it works?
Once the tool is run in a virtual machine(Virtualbox, Vmware, Qemu), it performs all the checks which are shown below and drops logs to the console about detected signatures until the “control” text is shown. In addition to that a separate .txt file with the finding name is created in the running directory for each detected signatures. Example; vboxBios.txt will be created for virtualbox bios signature.
sems tool is sent to malware sandbox like any other malware samples and waited until the completion of analysis. Detected signatures can be seen in “File Operations” section of the sandbox report hence sems drops separate .txt files for each findings.
- IDTR, LDTR, TR, SMSW, I/O Port
Cuckoo Sandbox Detection
- Hooked Function
- Core Number
Some Sandboxes Detection
Anubis , Thread Expert , Cuckoo , Sandboxie , CWSandbox
- Computer Name
- Core Number
- Check internet
- Disk spaces
Analysis Tools Detection
- Immunity Debugger
- Ida Pro
- Process Monitor
- Process Hacker
- Process Explorer
More Information: here
Thanks to Alican Akyol for sharing this tool with us. 😉