GitPlanet

Cheap and reliable Node.js hosting starts at $3/month, and $1/month static HTML hosting

Created with love in Canada, visit hostnodejs.com today

Feel like to post an Ad? Learn Details
All Projects → Phoenix1747 → fake-sandbox

Phoenix1747 / fake-sandbox

Licence: GPL-3.0 License
👁‍🗨 This script will simulate fake processes of analysis sandbox/VM software that some malware will try to avoid.

Programming Languages

Batchfile
5799 projects
powershell
5483 projects

Labels

windowstoolsandboxmalwarefakeprocesswindows-10spywareantivirus

Projects that are alternatives of or similar to fake-sandbox

JustEvadeBro
JustEvadeBro, a cheat sheet which will aid you through AMSI/AV evasion & bypasses.
Stars: ✭ 63 (-42.73%)
Mutual labels:  malware, antivirus
Ragnarok
Virus Package ( For Educational Purposes )
Stars: ✭ 23 (-79.09%)
Mutual labels:  malware, spyware
Batch-Antivirus
Batch Antivirus, a powerful antivirus suite written in batch with real-time protection and heuristical scanning.
Stars: ✭ 26 (-76.36%)
Mutual labels:  malware, antivirus
unprotect
Unprotect is a python tool for parsing PE malware and extract evasion techniques.
Stars: ✭ 75 (-31.82%)
Mutual labels:  sandbox, malware
Spyware
Python-based spyware for Windows that logs the foreground window activites, keyboard inputs. Furthermore it is able to take screenshots and and run shell commands in the background.
Stars: ✭ 31 (-71.82%)
Mutual labels:  malware, spyware
moneta
Moneta is a live usermode memory analysis tool for Windows with the capability to detect malware IOCs
Stars: ✭ 384 (+249.09%)
Mutual labels:  malware, process
memscrimper
Code for the DIMVA 2018 paper: "MemScrimper: Time- and Space-Efficient Storage of Malware Sandbox Memory Dumps"
Stars: ✭ 25 (-77.27%)
Mutual labels:  sandbox, malware
windows-defender
Malice Windows Defender AntiVirus Plugin
Stars: ✭ 31 (-71.82%)
Mutual labels:  malware, antivirus
Bold-Falcon
毕方智能云沙箱(Bold-Falcon)是一个开源的自动化恶意软件分析系统;方班网络安全综合实验-设计类；
Stars: ✭ 30 (-72.73%)
Mutual labels:  sandbox, malware
MultiAV2
MultiAV scanner with Python and JSON REST API using Malice Docker AV Containers and Docker-Machine based Autoscaling
Stars: ✭ 30 (-72.73%)
Mutual labels:  sandbox, antivirus
Owlyshield
Owlyshield is an EDR framework designed to safeguard vulnerable applications from potential exploitation (C&C, exfiltration and impact))..
Stars: ✭ 281 (+155.45%)
Mutual labels:  malware, antivirus
malice-av
Malice AntiVirus Plugins
Stars: ✭ 98 (-10.91%)
Mutual labels:  malware, antivirus
malware api class
Malware dataset for security researchers, data scientists. Public malware dataset generated by Cuckoo Sandbox based on Windows OS API calls analysis for cyber security researchers
Stars: ✭ 134 (+21.82%)
Mutual labels:  sandbox, malware
Automated-Malware-Analysis-List
My personal Automated Malware Analysis Sandboxes and Services
Stars: ✭ 20 (-81.82%)
Mutual labels:  sandbox, malware
IAT API
Assembly block for finding and calling the windows API functions inside import address table(IAT) of the running PE file.
Stars: ✭ 63 (-42.73%)
Mutual labels:  malware, antivirus
Defeat-Defender-V1.2
Powerful batch script to dismantle complete windows defender protection and even bypass tamper protection ..Disable Windows-Defender Permanently....Hack windows. POC
Stars: ✭ 885 (+704.55%)
Mutual labels:  malware, antivirus
Flying Sandbox Monster
Sandboxed, Rust-based, Windows Defender Client
Stars: ✭ 158 (+43.64%)
Mutual labels:  sandbox, antivirus
rhino
Agile Sandbox for analyzing Windows, Linux and macOS malware and execution behaviors
Stars: ✭ 49 (-55.45%)
Mutual labels:  sandbox, malware
The-MALWARE-Repo
A repository full of malware samples.
Stars: ✭ 380 (+245.45%)
Mutual labels:  malware, spyware
CleanUnwantedUpdates
A set of scripts to detect updates of Microsoft (TM) Windows (TM) OS which harm users' privacy and uninstall them
Stars: ✭ 24 (-78.18%)
Mutual labels:  malware, spyware
View All Similar Projects ➔

Fake Sandbox Processes (FSP)

latest version issues open pr

This small script will simulate fake processes of analysis, sandbox and VM software that some malware will try to avoid. You can download the original script made by @x0rz here (thanks, by the way).

You can also download my slightly optimized script from the root directory. The file is named fsp.ps1. This exact script is also used in the FSP installer.

Script-Features

  • Some (more advanced) spyware might stop executing correctly as long as the created processes run.
  • Requirements: Powershell (preinstalled on Win 7 and newer), that's all.
  • No system load at all (almost).

Installer-Features

  • Automatically install the script to your autostart directory, so that you don't have to execute it at every re-login.
  • Requirements: Only Powershell.
  • With uninstaller to purge all files.
  • Everything packed into one tiny offline package.
  • Optional auto-updater included, you can choose if you want it or not.

Usage:

Right-click the file and choose "Run with Powershell"

~ OR ~

Open the command line and paste this command (don't forget to adjust the path):

Powershell -executionpolicy remotesigned -F 'Your\Path\fsp.ps1'

After pressing enter you can choose to either start or stop all processes.

Autostart

If you're just using the script and start it manually, you will have to re-run it at every re-login or startup to create the processes again. In order to bypass this problem and autostart the script I made an easy-to-use installer.

  1. Download the fsp-installer.bat file from the release section or from the folder installer.
  2. Double-click it (do not start as administrator).
  3. Now you will see this command prompt window:

install1

  1. Choose "i" to start the installation.
  2. Now enter "y" to start installing or "n" to abort.
  3. If you entered "y" this image will now pop up:

install2

  1. Enter "y" to install the auto-updater or "n" to not install it (it'll work anyways, but the updater is recommended).

---> You can now close the window or press any key to close it. The installation is complete.

Uninstall

If you no longer want this program on your computer, you'll need the fsp-installer.bat file again. Run it and chose "u" to start the removal process. Then enter "y" if you are ready to purge all created files.

uninstall

If the process was successful, you'll see a confirmation screen - done. No files will remain on your system. You need to delete the installer, though.

Successfully tested on the following Windows versions:

  • Win 10 Professional
  • Win 8.1 Home
  • Win 7 Professional
Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].