+- Sinisterly (https://sinister.li)
+-- Forum: Coding (https://sinister.li/Forum-Coding)
+--- Forum: Visual Basic & .NET Framework (https://sinister.li/Forum-Visual-Basic-NET-Framework)
+--- Thread: Sky AV | Memory Scanning | Malware Identifier (/Thread-Sky-AV-Memory-Scanning-Malware-Identifier)
RE: Sky AV | Memory Scanning | Malware Identifier - Sophisticated - 12-17-2015
(12-17-2015, 04:17 AM)Killpot Wrote:Sure, that's fine, PM me a link, I'll review it now, I have the time.(12-17-2015, 04:16 AM)FUCK Wrote:(12-17-2015, 04:15 AM)Killpot Wrote:(12-17-2015, 04:13 AM)charles Wrote: This project looks awesome, unfortunately i don't have a windows partition anymore. so i can't test it.
You can still use Adobe Malware Classifier! It's made in python and is easily enough automated
(12-17-2015, 04:14 AM)FUCK Wrote:(12-17-2015, 04:12 AM)Killpot Wrote: Uhh, I think I've been at it for around 2-3 days? and most of the time was me being stuck on errors I shouldn't have been (Like implementing MaterialSkin)
I'll download it in the morning and do a review on it, as I know for a fact my computer has shit on it.
There isn't a download up yet, still working on an alpha release!
Oh shit, sorry must have misinterpreted, do you have a release that I may review, and I'll do it within the next few hours?
If not I'll wait
I can shoot you off a copy of the memory scanner, but every other tab is being worked on.
RE: Sky AV | Memory Scanning | Malware Identifier - Killpot - 12-17-2015
(12-17-2015, 04:18 AM)FUCK Wrote:(12-17-2015, 04:17 AM)Killpot Wrote:Sure, that's fine, PM me a link, I'll review it now, I have the time.(12-17-2015, 04:16 AM)FUCK Wrote:(12-17-2015, 04:15 AM)Killpot Wrote:(12-17-2015, 04:13 AM)charles Wrote: This project looks awesome, unfortunately i don't have a windows partition anymore. so i can't test it.
You can still use Adobe Malware Classifier! It's made in python and is easily enough automated
(12-17-2015, 04:14 AM)FUCK Wrote: I'll download it in the morning and do a review on it, as I know for a fact my computer has shit on it.
There isn't a download up yet, still working on an alpha release!
Oh shit, sorry must have misinterpreted, do you have a release that I may review, and I'll do it within the next few hours?
If not I'll wait
I can shoot you off a copy of the memory scanner, but every other tab is being worked on.
Sent :^)
RE: Sky AV | Memory Scanning | Malware Identifier - Killpot - 12-18-2015
--Update--
Summary:
No TL;DR, check OP for info on the future of this project
RE: Sky AV | Memory Scanning | Malware Identifier - Coefficient - 12-19-2015
What methods (winapi) are you using for memory scanning (NtQuerySystemInformation, ReadProcessMemory?) and does it nest kernel level?
Oh and btw id like to contribute to the project if you need anymore devs.
RE: Sky AV | Memory Scanning | Malware Identifier - Killpot - 12-20-2015
(12-19-2015, 08:01 PM)God Wrote: What methods (winapi) are you using for memory scanning (NtQuerySystemInformation, ReadProcessMemory?) and does it nest kernel level?
Oh and btw id like to contribute to the project if you need anymore devs.
It currently uses ReadProcessMemory, and it doesn't nest kernel level, I'm not sure what nesting it entails, but I'd love to have you in the project, currently it's a private GitHub repo, message me your skype and we can talk more.
RE: Sky AV | Memory Scanning | Malware Identifier - Skryptec - 01-23-2016
When is the release? Can't wait for it! :O
RE: Sky AV | Memory Scanning | Malware Identifier - Killpot - 01-23-2016
(01-23-2016, 06:51 PM)ThankYouForThis Wrote: When is the release? Can't wait for it! :O
It's currently sidelined as Clam AV, out heuristics engine is crashing every time we load our signature database. And I'm focusing on other projects like Ven0m right now.
RE: Sky AV | Memory Scanning | Malware Identifier - K00l - 02-02-2016
Pretty cool concept
planning on adding any memory signature checks for common RATs such as im4, nc or LL?
also, maybe add a feature that allows to suspend all threads of the detected process?
RE: Sky AV | Memory Scanning | Malware Identifier - Killpot - 02-02-2016
(02-02-2016, 05:56 PM)K00l Wrote: Pretty cool concept
planning on adding any memory signature checks for common RATs such as im4, nc or LL?
also, maybe add a feature that allows to suspend all threads of the detected process?
"memory signature checks" lolwat. and what's the point of suspending a thread after it's detected, I just kill it.