Top Tweets for #AntiVM

over 1 year ago

🚨#Opendir #Malware🚨 hxxp://66.63.187.250/zcry/ ⚠️#Meduza #Stealer ☣️gem1➡️b151d347d2f47dad2db0aa029dd6c9dd 📡66.63.187.173:15666 📦#Dotnet #Obfuscator ⚠️#Xmrig #CoinMiner #antiVM ☣️gem2➡️be89d598cd96443479c02b022ff70532 ⚠️#Powershell #Base64encoded ☣️📸script.ps1

ShanHolo's tweet photo. 🚨#Opendir #Malware🚨

hxxp://66.63.187.250/zcry/

⚠️#Meduza #Stealer
☣️gem1➡️b151d347d2f47dad2db0aa029dd6c9dd
📡66.63.187.173:15666
📦#Dotnet #Obfuscator
⚠️#Xmrig #CoinMiner #antiVM
☣️gem2➡️be89d598cd96443479c02b022ff70532
⚠️#Powershell #Base64encoded
☣️📸script.ps1 https://t.co/oDzKeCOwnU

m4n0w4r @kienbigmummy

about 4 years ago

👺#GuLoader #CloudEye The pain in ass ....🤢 Besides known strings like "vmtoolsdControlWndClass", "HookLibraryx86.dll", "VBoxTrayToolWndClass". Now for #antiVM, It adds checking the existence of drivers as well as services...Some hashes found ..(1/5)

kienbigmummy's tweet photo. 👺#GuLoader #CloudEye The pain in ass ....🤢
Besides known strings like "vmtoolsdControlWndClass", "HookLibraryx86.dll", "VBoxTrayToolWndClass". Now for #antiVM, It adds checking the existence of drivers as well as services...Some hashes found ..(1/5) https://t.co/3s7GJ9IaT4

ganeshkumar @ganeshnathan28

over 4 years ago

#antivm

Max_Malyutin @Max_Mal_

over 4 years ago

@Hexacorn @SBousseaden #Bumblebee uses the same Anti-VM technique:

Gameel Ali 🤘 @MalGamy12

almost 5 years ago

The attacker can detect VMware with a registry, So if we analyze any malware and see that malware tries to open the following paths on a registry, We can identify that it tries to detect Vmware and terminates the execution. #MalwareAnalysis #ReverseEngineering #AntiVM

MalGamy12's tweet photo. The attacker can detect VMware with a registry, So if we analyze any malware and see that malware tries to open the following paths on a registry, We can identify that it tries to detect Vmware and terminates the execution.
#MalwareAnalysis #ReverseEngineering #AntiVM https://t.co/cKpDJalPA4

Gameel Ali 🤘 @MalGamy12

almost 5 years ago

Malware can search on these files and if it finds anything of them will detect Vmware. #MalwareAnalysis #ReverseEngineering #AntiVM

MalGamy12's tweet photo. Malware can search on these files and if it finds anything of them will detect Vmware.
#MalwareAnalysis #ReverseEngineering #AntiVM https://t.co/yrfbguvoxE

Gameel Ali 🤘 @MalGamy12

almost 5 years ago

The attacker can use (RegOpenKeyExA) API to open the following path 'HKEY_LOCAL_MACHINE\\HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 0\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0' to check if malware is running under VMware or not. #MalwareAnalysis #ReverseEngineering #AntiVM

$MalGamy12's tweet photo. The attacker can use (RegOpenKeyExA) API to open the following path 'HKEY_LOCAL_MACHINE\\HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 0\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0' to check if malware is running under VMware or not. #MalwareAnalysis #ReverseEngineering #AntiVM https://t.co/6YsNnFbobT$

SentinelLabs

@LabsSentinel

almost 6 years ago

🤡 Thanos Ransomware | RIPlace, Bootlocker and More Added to Feature Set - By Jim Walter https://t.co/YpLRSwlwNp #Ransomware #Bootlocker #RIPlace #dotnet #AntiVM #Polymorphic #FTP

Sam ☁️🪵 @Sam0x90

almost 6 years ago

Calling CPUID with eax=0 returns CPU manufacturer ID string in ebx,edx,ecx (in that order). In vmware should be "VMwareVMware" in VirtualBox is "GenuineIntel" looks more legit no? :D #RE #AntiVM #ReverseEngineering #CPU @virtualbox

Lokesh @Loki_RE_artist

about 6 years ago

#GuLoader uses #AntiVM #antidebugger techniques in addition to #antiattach & #unhooking techniques used in previous campaign earlier this year. run: https://t.co/0xRSxUgBV9 @VK_Intel @malwrhunterteam @James_inthe_box @JAMESWT_MHT

Loki_RE_artist's tweet photo. #GuLoader uses #AntiVM #antidebugger techniques in addition to #antiattach & #unhooking techniques used in previous campaign earlier this year.

run: https://t.co/0xRSxUgBV9

@VK_Intel @malwrhunterteam @James_inthe_box @JAMESWT_MHT https://t.co/UDIHJmcT4J

mak @maciekkotowicz

about 6 years ago

Today's #Trickbot loaders with a screen resolution #antivm trick, if you have 800x600 or 1024x768 resolution - you are safe! ;] cc @VK_Intel @James_inthe_box @JAMESWT_MHT @abuse_ch

maciekkotowicz's tweet photo. Today's #Trickbot loaders with a screen resolution #antivm trick, if you have 800x600 or 1024x768 resolution - you are safe! ;] cc @VK_Intel @James_inthe_box @JAMESWT_MHT @abuse_ch https://t.co/mbGE5IwLH0

189

Frost @fr0s7_

about 6 years ago

#Formbook #Guloader #AntiVM checking for %ProgramData%\qemu-ga\ https://t.co/NQGahQgbm7 @James_inthe_box @JAMESWT_MHT @malwrhunterteam

m4n0w4r @kienbigmummy

about 6 years ago

I and my teammate just analyzed a variant of #GuLoader and summarize its anti-vm techniques. https://t.co/MkJ7erH0Dw #AntiVM

kienbigmummy's tweet photo. I and my teammate just analyzed a variant of #GuLoader and summarize its anti-vm techniques.
https://t.co/MkJ7erH0Dw #AntiVM https://t.co/sraRbFP1c8

moto_sato

@58_158_177_102

over 6 years ago

今日のコロナ関連のマルウェアメール Today(JST)'s #COVID19 #malspam #antisandbox #antivm subject : RE: Delayed Payment Due To COVID-19 Situation sample : https://t.co/6F0xU6MY0q https://t.co/6Jy4dNeNcz https://t.co/vhXXZ2mUSq

58_158_177_102's tweet photo. 今日のコロナ関連のマルウェアメール

Today(JST)'s #COVID19 #malspam #antisandbox #antivm
subject : RE: Delayed Payment Due To COVID-19 Situation
sample : https://t.co/6F0xU6MY0q
https://t.co/6Jy4dNeNcz
https://t.co/vhXXZ2mUSq https://t.co/EIsvFRuEEf

moto_sato

@58_158_177_102

over 6 years ago

今日のコロナ関連のマルウェアメール Today(JST)'s #COVID19 #malspam #antisandbox #antivm subject : RE: (COVID-19) CI OF NEW ORDER---3013670 sample : https://t.co/RwLfgG4PhL https://t.co/pJmR4XFLSv https://t.co/6AyL9FvSgw

58_158_177_102's tweet photo. 今日のコロナ関連のマルウェアメール

Today(JST)'s #COVID19 #malspam #antisandbox #antivm
subject : RE: (COVID-19) CI OF NEW ORDER---3013670
sample : https://t.co/RwLfgG4PhL
https://t.co/pJmR4XFLSv
https://t.co/6AyL9FvSgw https://t.co/WG8Y2RPDo6

reecDeep @reecdeep

over 6 years ago

👾#ursnif #Malware #Gozi #dreambot with #VBS #antivm c2: needforbestpropouse.]xyz soft=3 version=214 build=112 ➡️🆕 KEY🔑 [32291667LSJUYNUU]⬅️ @JAMESWT_MHT @James_inthe_box @merlos1977 @VK_Intel @matte_lodi #Cybersecurity #ThreatIntel #ThreatIntelligence #Threat #infosec

reecdeep's tweet photo. 👾#ursnif #Malware #Gozi #dreambot with #VBS #antivm

c2: needforbestpropouse.]xyz

soft=3
version=214
build=112

➡️🆕 KEY🔑 [32291667LSJUYNUU]⬅️

@JAMESWT_MHT @James_inthe_box @merlos1977 @VK_Intel @matte_lodi
#Cybersecurity #ThreatIntel #ThreatIntelligence #Threat #infosec https://t.co/PY03QTmevQ

Manoj Kshirsagar @manoj_kshirsagr

about 7 years ago

#DarkHydrus #APT Sample: https://t.co/15PCxYs6U2 Uses #AntiVM & #AntiSandbox techniques. Drops file at %APPDATA%\OneDrive.exe #Persistence %AppData%\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDrive.lnk performs DNS exfiltration to transfer collected info to C2

$manoj_kshirsagr's tweet photo. #DarkHydrus #APT Sample: https://t.co/15PCxYs6U2 Uses #AntiVM & #AntiSandbox techniques. Drops file at %APPDATA%\OneDrive.exe #Persistence %AppData%\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDrive.lnk performs DNS exfiltration to transfer collected info to C2 https://t.co/7pezgyP1tI$

Alexandre Borges

@ale_sp_brazil

about 8 years ago

(interesting) Detecting Hypervisor Presence on Windows 10 -- https://t.co/mGN9jG6ziU #windows10 #antivm #reversing

Warren Mercer

@SecurityBeard

about 8 years ago

#GravityRAT shows that being determined and innovative can result in low detection attacks. It was not a complexly written or obfuscated piece of malware BUT the authors AntiVM temperature check for the CPU is causing things to heat up #punintended #antivm #temperaturechecks

eScan AV @escan_tweet

over 8 years ago

BRIEF ANALYSIS OF OCI.DLL. https://t.co/BSJi0uhgeh #antidebugging #antiVM #CPUID # eScanantiransomware #MSDTC #cybersecurity #cyberattack #escan #escanantivirus #PBAE

Ayoub Faouzi @aybfaouzi

almost 9 years ago

New #AntiVM trick in #CCleaner malware, IcmpSendEcho() to delay execution. Updated #alkhaser https://t.co/7ED3v0D4tG to support it.

aybfaouzi's tweet photo. New #AntiVM trick in #CCleaner malware, IcmpSendEcho() to delay execution. Updated #alkhaser https://t.co/7ED3v0D4tG to support it. https://t.co/iVuZSApwcn

110

Top Tweets for #AntiVM

Last Seen Hashtags on Sotwe

Trends for you

Most Popular Users