CPR evasion encyclopedia: The Check Point evasion repository

guest · Feb 28, 2020

CPR evasion encyclopedia: The Check Point evasion repository
February 27, 2020
https://research.checkpoint.com/2020/cpr-evasion-encyclopedia-the-check-point-evasion-repository/

As malicious threats evolve, the necessity in automated solutions to analyze such threats emerges. It’s a very common case when malware samples are executed in some kind of virtualized environment.

These environments differ from usual host systems by a huge amount of artifacts: non-common files, registry keys, system objects, etc. By examining such artifacts malware samples are able to say if they are run in a virtualized environment.
Depending on the answer to this question, malware will continue its usual execution thus giving the researchers an opportunity to monitor its behavior – or will behave itself in an unexpected way and reveal nothing about its behavior.

In this encyclopedia we have attempted to gather all the known ways to detect virtualized environment grouping them into big categories.
Click to expand...

Within each category the reader will find the following information:

Description of the technique

Code sample showing its usage

Signature recommendations to track attempts to apply this technique

Table with breakdown of which particular environments are detected with the help of certain constants

Possible countermeasures

Click to expand...

Evasion encyclopedia

Log in or Sign up

CPR evasion encyclopedia: The Check Point evasion repository

guest Guest

Log in or Sign up

CPR evasion encyclopedia: The Check Point evasion repository

guest Guest

Useful Searches