Anti-VM - VM identifiers in disk enums

[recvfrom]

From [1], disk enums in HKLM\System\CurrentControlSet\Services\Disk\Enum sometimes contains strings like Virtual, VMW, or Vbox, which some malware uses as an anti-VM check. Would it be worth also checking for this in al-khaser?

[1] https://cofense.com/kutaki-malware-bypasses-gateways-steal-users-credentials/

[Waterman178]

good idea

[recvfrom]

Another example [2] - Smokeloader checks System\CurrentControlSet\Services\Disk\Enum\IDE and System\CurrentControlSet\Services\Disk\Enum\SCSI for qemu, virtio, vmware vbox or xen

[2] https://research.checkpoint.com/2019-resurgence-of-smokeloader/

[ayoubfaouzi]

Hello @recvfrom

Thanks ! I will add those in the next release.

Cheers.