+- Sinisterly (https://sinister.li)
+-- Forum: Coding (https://sinister.li/Forum-Coding)
+--- Forum: Visual Basic & .NET Framework (https://sinister.li/Forum-Visual-Basic-NET-Framework)
+--- Thread: Sky AV | Memory Scanning | Malware Identifier (/Thread-Sky-AV-Memory-Scanning-Malware-Identifier)
Sky AV | Memory Scanning | Malware Identifier - Killpot - 12-15-2015
Yo.
So starting off this will just be an announcement thread and I'll update a changelog frequently of how the projects currently doing.
The program is currently VERY alpha, however the core functionality is there.
Features:
- RunPE Detector: Compares sections of process module and it's host, if there's more than 5 it's likely a RunPE, thus it kills the process
- Win32 API Hooking: This feature allows real time detections, as process are created they are scanned, same goes for files
- Adobe Malware Classifier: This is the incorporation of Adobe's Malware Classifier script, written in python it's the core of the Malware Analysis
- In Depth Settings: Pretty much everything is customizable, you'll be able to set everything to where you feel it should be
- Bulk File Scanning: Chose singular files to scan, or scan whole directories!
- Right click menu integration: Right click on files to scan them on the fly!
Planned Features:
- VirusCheckMate.com integration
- Better RunPE detection (aside section mismatches)
- Thread Hijacking for killing protected processes
- Not a shitty GUI
- Plugins? (MAYBE)
Memory Scanning:
I'll answer any questions or comments you guys have, if you have any suggestions I'd like to hear them!
--UPDATE--
So I've begun working on a not ugly GUI, it actually looks quite nice, I've used Google's Material Skin it's animated.
I've successfully upgraded out RunPE scanning, we can now inspect 64 bit processes, however I have allot more calibration ahead of me as allot of
system processes are detected as RunPE's because that's effectively what they're doing, it's the same as having VS debug, it's hosting the real
application, and thus has allot of mismatched headers, so for now, I'll just get detections down, even if it's a system process and deal with sorting
out which ones to kill later.
--UPDATE--
x64 process scanning is out of the question for now.
added new video demoing memory scanning
New GUI :^)
![[Image: sz5yJxK.png]](http://i.imgur.com/sz5yJxK.png)
--MOTHER OF UPDATES--
HOO BOY YOU'RE GONNA WANNA SIT DOWN FOR THIS ONE
Ok, so a lot's happened lately and while I haven't changed much on the note of the program this is worth of an update as things are going to take a turn from where they were originally headed.
So, first off, I've partnered up with 2 other users that will massively improve SkyAV, I won't name them, they can post here if they want it to be known.
With these 2 users, one will be coding the program alongside me, this user will also take care of all web related processes of the program.
We'll be commercializing the product, so sorry for all that were banking on getting the source, I may still be releasing parts of it as I go along however.
The program will still be free to use, but many of the features will be premium, and these premium features will come as monthly fees, we have yet to decide the pricing.
We'll be implementing a full blown Heuristics Engine that the user and I will be coding from scratch, we will be implementing methods of submitting files to be scanned by hand.
Most of the AV will be handled server side via LiteCode and a few other tricks I have up my sleeve. However with this big update comes a lot of opportunity. As doing this
will allow me to spend a lot more time on the project. As always I'll be keeping this thread updated on it's status. We'll be needing beta testers eventually so keep an eye
out for that, alongside the fact that we will be needing to build our signatures database, so eventually I'll be putting in place some system that will reward you
for submitting a file you know to be malicious that our Heuristics Engine isn't detecting. I have yet to decide what the reward will be, money, btc, subscription time, etc.
I look forward to hearing your thoughts!
RE: Sky AV | Memory Scanning | Malware Identifier - Red_SF - 12-15-2015
Awesome shit, keep these products coming to the community. As always i can Vouch for killpot <3
RE: Sky AV | Memory Scanning | Malware Identifier - Killpot - 12-15-2015
(12-15-2015, 03:38 AM)Raymond Reddington Wrote: Awesome shit, keep these products coming to the community. As always i can Vouch for killpot <3
Thanks m8!
Updated with live memory scanning demo
RE: Sky AV | Memory Scanning | Malware Identifier - Buildoman - 12-15-2015
This actually looks really fuckin sick nice job yet again killpot!
RE: Sky AV | Memory Scanning | Malware Identifier - Killpot - 12-15-2015
(12-15-2015, 04:09 AM)Buildoman Wrote: This actually looks really fuckin sick nice job yet again killpot!
Thanks babe <3 Glad I have people looking forward to the release : ^)
RE: Sky AV | Memory Scanning | Malware Identifier - Esoterith - 12-15-2015
My goal: first download on release
RE: Sky AV | Memory Scanning | Malware Identifier - Killpot - 12-15-2015
(12-15-2015, 04:31 AM)Vespei Wrote: My goal: first download on release
You can look forward to it :^)
RE: Sky AV | Memory Scanning | Malware Identifier - Killpot - 12-16-2015
Thread updated for new changes
Summary:
New & Better GUI
64 Bit process scanning added, calibration needed.
RE: Sky AV | Memory Scanning | Malware Identifier - AFK - 12-16-2015
Since my occupation deals with malware and malware removal, I'd be more than glad for you to send me a private version of this so I can test it and send the results back.
RE: Sky AV | Memory Scanning | Malware Identifier - Killpot - 12-16-2015
(12-16-2015, 10:34 PM)Maximum Wrote: Since my occupation deals with malware and malware removal, I'd be more than glad for you to send me a private version of this so I can test it and send the results back.
Well I could use some advice on improving my RunPE detections, because as of now it's not very accurate and multiple variables can lead to false positives, if you don't mind would you PM me your contact info, like a skype so we can talk more?