Package modules :: Package auxiliary :: Module disguise :: Class Disguise
[hide private]
[frames] | no frames]

Class Disguise

source code

                    object --+    
                             |    
lib.common.abstracts.Auxiliary --+
                                 |
                                Disguise

Disguise the analysis environment.

Instance Methods [hide private]
 
change_productid(self)
Randomizes Windows ProductId.
source code
 
patch_scsi_identifiers(self) source code
 
patch_bios(self) source code
 
patch_acpi(self) source code
 
patch_processor(self) source code
 
patch_manufacturer(self) source code
 
patch_hdd_path(self) source code
 
start(self) source code

Inherited from lib.common.abstracts.Auxiliary: __init__

Inherited from object: __delattr__, __format__, __getattribute__, __hash__, __new__, __reduce__, __reduce_ex__, __repr__, __setattr__, __sizeof__, __str__, __subclasshook__

Class Variables [hide private]
  HDD_IDENTIFIERS = ["ST9160411AS",]
  HDD_PATHS = ["IDE\\DiskST9160411AS____________________________...
  CDROM_IDENTIFIERS = ["HL-DT-ST RW/DVD MU10N",]
  SYSTEM_BIOS_DATES = ["03/11/11", "01/09/09",]
  SYSTEM_BIOS_VERSIONS = [["LENOVO - 3220", "Ver 1.00PARTTBL("],...
  VIDEO_BIOS_DATES = ["02/10/20", "06/12/20",]
  VIDEO_BIOS_VERSIONS = [["Hardware Version 0.0", "PARTTBLX"],]
  BIOS_VERSIONS = ["6FET56WW (2.02 )", "7UET92WW (3.22 )",]
  SYSTEM_MANUFACTURERS = ["LENOVO",]
  SYSTEM_PRODUCTNAMES = ["64755N2", "2241W2U",]
Properties [hide private]

Inherited from object: __class__

Method Details [hide private]

change_productid(self)

source code 

Randomizes Windows ProductId. The Windows ProductId is occasionally used by malware to detect public setups of Cuckoo, e.g., Malwr.com.


Class Variable Details [hide private]

HDD_PATHS

Value:
["IDE\\DiskST9160411AS_____________________________LV14____", "IDE\\Di\
skKINGSTON_SV300S_________________________541A____",]

SYSTEM_BIOS_VERSIONS

Value:
[["LENOVO - 3220", "Ver 1.00PARTTBL("], ["LENOVO - 2020", "Ver 1.00PAR\
TTBLX"],]