A proof-of-concept malware application that implements common anti-analysis techniques to test security tools and sandbox environments.
Al-Khaser is a proof-of-concept malware application that implements a wide range of anti-analysis techniques used by real malware in the wild. It helps security researchers and professionals test their anti-malware systems, debuggers, and sandbox environments by simulating common evasion methods. The tool covers detection of virtual machines, debuggers, sandboxes, and analysis tools to evaluate defensive effectiveness.
Security researchers, malware analysts, and developers of anti-malware or sandbox solutions who need to test their systems against real-world evasion techniques.
Al-Khaser provides a comprehensive, open-source collection of malware evasion techniques in one tool, saving time compared to researching individual methods. It's specifically designed for testing and improving security defenses rather than malicious use.
Public malware techniques used in the wild: Virtual Machine, Emulation, Debuggers, Sandbox detection.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Implements over 50 anti-debugging methods, extensive VM detection for VirtualBox/VMware/QEMU, and timing attacks, as detailed in the README's exhaustive lists.
Allows targeted testing with flags like --check DEBUG or --check VMWARE, enabling selective activation of specific evasion checks for focused environment evaluation.
Mimics actual malware techniques such as code injection via CreateRemoteThread and anti-dumping by erasing PE headers, providing authentic stress tests for defenses.
Welcomes pull requests and references tools like Pafish, fostering collaboration and continuous improvement in evasion methodology.
Relies on Windows APIs and .exe binaries, with no support for Linux or macOS, limiting its use in diverse or cross-platform security testing scenarios.
The README lists several 'todo' items, such as mouse click checks and dialog boxes for human interaction, indicating gaps in coverage and lack of recent updates.
Provides pre-built binaries but no clear build instructions in the README; modifying the source requires navigating Windows-specific development environments without detailed guides.
As a proof-of-concept, its aggressive techniques like memory manipulation and code injection can cause crashes or instability if run outside controlled, isolated environments.