Skip to content

Instantly share code, notes, and snippets.

@kaganisildak

kaganisildak/Detect Online Sandbox

Created March 8, 2021 07:37
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save kaganisildak/23c00c6c1525fb907a6246d603d01170 to your computer and use it in GitHub Desktop.
Save kaganisildak/23c00c6c1525fb907a6246d603d01170 to your computer and use it in GitHub Desktop.
Download ZIP
Detect Online Sandbox : Any.Run
Raw
Detect Online Sandbox
Any.Run uses a fake root certificate to spy on traffic in the sandbox. The first information about the system can be obtained by querying the root certificate information.
The QEMU Agent application is modified and used to monitor the applications running in the virtual machine. In this way, api hooking and monitoring is performed. If a process named "srvpost.exe" is running and "winanr.dll", "winsanr.dll" libraries are loaded, we can fully understand that the Any.Run agent is running.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment