![]() |
|
|
|
#1
|
||||
|
||||
|
When you try to analyze a suspicious file (malware), usually you do it in a virtual machine, and in case where the suspicious file uses some tricks to detect your virtual analysis lab, based on its strings or hardware signature, here you need to make a custom configuration or patch some strings/hardware signature to avoid virtual machine detection.
EP_X0FF has made a great job by releasing and sharing (tut and tool with source) VM detection mitigation for (VirtualBox)
__________________
Computer Forensics |
![]() |
| Thread Tools | |
| Display Modes | |
|
|
Similar Threads
|
||||
| Thread | Thread Starter | Forum | Replies | Last Post |
| kernelmode.info (The End of Adventure) | Insid3Code | General Discussion | 10 | 04-01-2018 07:21 |
| DSEFix x64 (kernelmode.info) | Insid3Code | x64 OS | 1 | 05-15-2017 01:53 |
| [C/C++] UACME (kernelmode.info) | Insid3Code | Source Code | 0 | 03-29-2015 18:32 |
| [C/C++ ] VMDE (kernelmode.info) | Insid3Code | Source Code | 0 | 03-18-2015 20:47 |
| WinObjEx64 (kernelmode.info) | Insid3Code | Community Tools | 1 | 03-02-2015 00:04 |