sandbox_evasion icon indicating copy to clipboard operation
sandbox_evasion copied to clipboard

Sandbox evasion code snippets developped in Golang

built-with-love made-with-go escapes-like-a-king works-on-linux works-on-windows no-ragrets

🚩Preamble

This project is for educational purpose only, and it is not intended to be used.
This evasion module was first developed has a module for my ransomware (that you will find in the Related Project section)
The list of the test is available below, it has been tested on both Linux and Windows systems.
As you might find while reading the code, you will be able to see where I got the code from.
Of course, the codes has\ been modified to match my requirements and also has been improved in order to make it more reliable and efficient.
Feel free to fork this project or modify it has you want.

πŸ”— Related Project

Some codes are related to other projects that I have done. They are available on the following links :

  • LCJ - My Ransomware first developed as a school project

πŸš€ Sandbox Evasion Module

Code that is intended to be used inside a malware in order to escape sandboxes.
You will find 2 pieces of code that you can launch to test the evasion techniques.
The code has to be implemented inside your malware, and has to be modified to match your requirements.

πŸ“Ž Initial commit modules

The table below shows which evasion techniques works on which OS. As said previously, it has been tested and re-tested multiple times.
I won't say that it is bug-free, but as per my advanced tests, it has none for now.

Evasion Techniques Windows Linux
evade_vm_files βœ… βœ…
evade_hostname βœ… βœ…
evade_mac βœ… βœ…
evade_cpu_count βœ… βœ…
evade_time_acceleration βœ… βœ…
evade_tmp βœ… βœ…
evade_utc βœ… βœ…
evade_disk_size βœ… βœ…
evade_screen_size βœ… ⬜️
evade_foreground_window βœ… ⬜️
evade_system_memory βœ… ⬜️
evade_printer βœ… ⬜️
evade_clicks_count βœ… ⬜️

πŸ–Š Authors

πŸ“œ License