modules.auxiliary.disguise.Disguise

Package modules :: Package auxiliary :: Module disguise :: Class Disguise |
[hide private]
[frames] | no frames]

# Class Disguise

source code

                        object --+
                                 |
    lib.common.abstracts.Auxiliary --+
                                     |
                                    Disguise

Disguise the analysis environment.

Instance Methods | [hide private]
change_productid(self) Randomizes Windows ProductId. | source code
patch_scsi_identifiers(self) | source code
patch_bios(self) | source code
patch_acpi(self) | source code
patch_processor(self) | source code
patch_manufacturer(self) | source code
patch_hdd_path(self) | source code
start(self) | source code
Inherited from `lib.common.abstracts.Auxiliary`: `__init__` Inherited from `object`: `__delattr__`, `__format__`, `__getattribute__`, `__hash__`, `__new__`, `__reduce__`, `__reduce_ex__`, `__repr__`, `__setattr__`, `__sizeof__`, `__str__`, `__subclasshook__`

Class Variables | [hide private]
| HDD_IDENTIFIERS = `["ST9160411AS",]`
| HDD_PATHS = `["IDE\\DiskST9160411AS____________________________`...``
| CDROM_IDENTIFIERS = `["HL-DT-ST RW/DVD MU10N",]`
| SYSTEM_BIOS_DATES = `["03/11/11", "01/09/09",]`
| SYSTEM_BIOS_VERSIONS = `[["LENOVO - 3220", "Ver 1.00PARTTBL("],`...``
| VIDEO_BIOS_DATES = `["02/10/20", "06/12/20",]`
| VIDEO_BIOS_VERSIONS = `[["Hardware Version 0.0", "PARTTBLX"],]`
| BIOS_VERSIONS = `["6FET56WW (2.02 )", "7UET92WW (3.22 )",]`
| SYSTEM_MANUFACTURERS = `["LENOVO",]`
| SYSTEM_PRODUCTNAMES = `["64755N2", "2241W2U",]`

Properties | [hide private]
Inherited from `object`: `__class__`

Method Details | [hide private]

### change_productid(self) | source code
Randomizes Windows ProductId. The Windows ProductId is occasionally used by malware to detect public setups of Cuckoo, e.g., Malwr.com.

Class Variable Details | [hide private]

  ### HDD_PATHS Value:
      ["IDE\\DiskST9160411AS_____________________________LV14____", "IDE\\Di
      skKINGSTON_SV300S_________________________541A____",]

  ### SYSTEM_BIOS_VERSIONS Value:
      [["LENOVO - 3220", "Ver 1.00PARTTBL("], ["LENOVO - 2020", "Ver 1.00PAR
      TTBLX"],]