mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-02 08:57:48 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
85 lines
2.0 KiB
Markdown
85 lines
2.0 KiB
Markdown
# Malware Sandbox Evasion Techniques API Reference
|
|
|
|
## MITRE ATT&CK T1497 Sub-techniques
|
|
|
|
| Sub-technique | ID | Evasion Method |
|
|
|---|---|---|
|
|
| System Checks | T1497.001 | VM artifacts, registry keys, MAC prefixes, process names |
|
|
| User Activity Based Checks | T1497.002 | Mouse movement, keyboard input, foreground window |
|
|
| Time Based Evasion | T1497.003 | GetTickCount, sleep inflation, RDTSC timing |
|
|
|
|
## Cuckoo Sandbox Report JSON Structure
|
|
|
|
### API Call Format
|
|
```json
|
|
{
|
|
"behavior": {
|
|
"processes": [
|
|
{
|
|
"process_name": "malware.exe",
|
|
"pid": 1234,
|
|
"calls": [
|
|
{
|
|
"api": "GetTickCount",
|
|
"category": "system",
|
|
"arguments": {},
|
|
"return": "123456789"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
}
|
|
```
|
|
|
|
## Timing API Indicators
|
|
|
|
| API | Purpose | Evasion Use |
|
|
|---|---|---|
|
|
| GetTickCount / GetTickCount64 | System uptime in ms | Check if uptime < 20min (sandbox) |
|
|
| QueryPerformanceCounter | High-res timer | Measure sleep accuracy |
|
|
| GetSystemTimeAsFileTime | System time | Detect time acceleration |
|
|
| NtQuerySystemTime | Kernel time query | Compare with user-mode time |
|
|
| RDTSC | CPU timestamp counter | Detect VM overhead in timing |
|
|
|
|
## VM Artifact Indicators
|
|
|
|
### Registry Keys
|
|
```
|
|
HKLM\SOFTWARE\VMware, Inc.\VMware Tools
|
|
HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions
|
|
HKLM\HARDWARE\ACPI\DSDT\VBOX__
|
|
HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest
|
|
```
|
|
|
|
### VM Process Names
|
|
```
|
|
vmtoolsd.exe, vmwaretray.exe # VMware
|
|
vboxservice.exe, vboxtray.exe # VirtualBox
|
|
qemu-ga.exe # QEMU
|
|
prl_tools.exe # Parallels
|
|
```
|
|
|
|
### VM MAC Address Prefixes
|
|
```
|
|
00:0C:29 VMware
|
|
00:50:56 VMware
|
|
08:00:27 VirtualBox
|
|
00:1C:42 Parallels
|
|
52:54:00 QEMU/KVM
|
|
```
|
|
|
|
## AnyRun Report API
|
|
|
|
### Get Report
|
|
```
|
|
GET https://api.any.run/v1/analysis/{task_id}
|
|
Authorization: API-Key <key>
|
|
```
|
|
|
|
## CLI Usage
|
|
```bash
|
|
python agent.py --report cuckoo_report.json --output evasion_report.json
|
|
python agent.py --report report.json --min-sleep-ms 30000
|
|
```
|