TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE

YARA detection rule by CYFARE · Unknown
Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
import "math"
import "pe"
rule TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
{
    meta:
        author                       = "CYFARE"
        description                  = "Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments"
        reference                    = "https://cyfare.net/"
        date                         = "2026-03-18"
        version                      = "1.0.0"
        yarahub_uuid                 = "91d7d883-c367-4ef5-a27b-2f8eb508b362"
        yarahub_license              = "CC0 1.0"
        yarahub_rule_matching_tlp    = "TLP:WHITE"
        yarahub_rule_sharing_tlp     = "TLP:WHITE"
        yarahub_reference_md5        = "d41d8cd98f00b204e9800998ecf8427e"

    strings:

                        
                $reg_vmw1 = "SOFTWARE\\VMware, Inc.\\VMware Tools" ascii wide nocase
        $reg_vmw2 = "SOFTWARE\\VMware, Inc.\\VMware VGAuth" ascii wide nocase
        $reg_vmw3 = "SYSTEM\\CurrentControlSet\\Services\\VMTools" ascii wide nocase
        $reg_vmw4 = "SYSTEM\\CurrentControlSet\\Services\\vmci" ascii wide nocase
        $reg_vmw5 = "SYSTEM\\CurrentControlSet\\Services\\vmhgfs" ascii wide nocase

                $reg_vbx1 = "SOFTWARE\\Oracle\\VirtualBox Guest Additions" ascii wide nocase
        $reg_vbx2 = "SYSTEM\\CurrentControlSet\\Services\\VBoxGuest" ascii wide nocase
        $reg_vbx3 = "SYSTEM\\CurrentControlSet\\Services\\VBoxMouse" ascii wide nocase
        $reg_vbx4 = "SYSTEM\\CurrentControlSet\\Services\\VBoxSF" ascii wide nocase
        $reg_vbx5 = "SYSTEM\\CurrentControlSet\\Services\\VBoxVideo" ascii wide nocase
        $reg_vbx6 = "HARDWARE\\ACPI\\DSDT\\VBOX__" ascii wide nocase

                $reg_hyv1 = "SYSTEM\\CurrentControlSet\\Services\\vmbus" ascii wide nocase
        $reg_hyv2 = "SOFTWARE\\Microsoft\\Virtual Machine\\Guest\\Parameters" ascii wide nocase
        $reg_hyv3 = "SYSTEM\\CurrentControlSet\\Services\\vmicheartbeat" ascii wide nocase
        $reg_hyv4 = "SYSTEM\\CurrentControlSet\\Services\\vmicshutdown" ascii wide nocase

                $reg_qmu1 = "HARDWARE\\Description\\System\\SystemBiosVersion" ascii wide nocase
        $reg_qmu2 = "HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 0\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0" ascii wide nocase

                $reg_xen1 = "SYSTEM\\CurrentControlSet\\Services\\xenevtchn" ascii wide nocase
        $reg_xen2 = "SYSTEM\\CurrentControlSet\\Services\\xennet" ascii wide nocase
        $reg_xen3 = "SYSTEM\\CurrentControlSet\\Services\\xenvdb" ascii wide nocase

                        
                $file_vmw1 = "vmtoolsd.exe" ascii wide nocase
        $file_vmw2 = "vmwaretray.exe" ascii wide nocase
        $file_vmw3 = "vmwareuser.exe" ascii wide nocase
        $file_vmw4 = "vmacthlp.exe" ascii wide nocase
        $file_vmw5 = "vmware-vmx.exe" ascii wide nocase
        $file_vmw6 = "vmGuestLib.dll" ascii wide nocase
        $file_vmw7 = "vmmouse.sys" ascii wide nocase
        $file_vmw8 = "vmhgfs.sys" ascii wide nocase

                $file_vbx1 = "VBoxService.exe" ascii wide nocase
        $file_vbx2 = "VBoxTray.exe" ascii wide nocase
        $file_vbx3 = "VBoxControl.exe" ascii wide nocase
        $file_vbx4 = "VBoxMouse.sys" ascii wide nocase
        $file_vbx5 = "VBoxGuest.sys" ascii wide nocase
        $file_vbx6 = "VBoxSF.sys" ascii wide nocase
        $file_vbx7 = "VBoxDisp.dll" ascii wide nocase
        $file_vbx8 = "VBoxHook.dll" ascii wide nocase
        $file_vbx9 = "VBoxMRXNP.dll" ascii wide nocase

                $file_hyv1 = "vmbus.sys" ascii wide nocase
        $file_hyv2 = "VMBusVideoM.sys" ascii wide nocase
        $file_prl1 = "prl_tools.exe" ascii wide nocase
        $file_prl2 = "prl_cc.exe" ascii wide nocase
        $file_qmu1 = "qemu-ga.exe" ascii wide nocase
        $file_qmu2 = "qga.exe" ascii wide nocase

                $file_xen1 = "xenservice.exe" ascii wide nocase
        $file_xen2 = "xen.sys" ascii wide nocase

                        
        $hw_vmw1 = "VMware Virtual" ascii wide nocase
        $hw_vmw2 = "VMware" ascii wide
        $hw_vmw3 = "VM_PLATFORM_VMWARE" ascii wide nocase
        $hw_vbx1 = "VBOX HARDDISK" ascii wide nocase
        $hw_vbx2 = "VirtualBox" ascii wide
        $hw_vbx3 = "VBOX" ascii wide
        $hw_hyv1 = "Microsoft Hv" ascii wide nocase
        $hw_hyv2 = "Hyper-V" ascii wide
        $hw_qmu1 = "QEMU" ascii wide
        $hw_qmu2 = "BOCHS" ascii wide nocase
        $hw_qmu3 = "Standard PC (Q35" ascii wide nocase
        $hw_xen1 = "Xen" ascii wide
        $hw_xen2 = "XenVMMXenVMM" ascii wide
        $hw_kvmx = "KVMKVMKVM" ascii wide
        $hw_wine = "Wine" ascii wide

                $mac_vmw = { 00 0C 29 }         $mac_vmw2 = { 00 50 56 }         $mac_vbx = { 08 00 27 }         $mac_hyv = { 00 15 5D }         $mac_xen = { 00 16 3E }         $mac_prl = { 00 1C 42 } 
                        
                $cpuid_op     = { 0F A2 }
        $cpuid_leaf   = { B8 00 00 00 40 0F A2 } 
                $cpuid_vmw    = "VMwareVMware" ascii wide
        $cpuid_vbx    = "VBoxVBoxVBox" ascii wide
        $cpuid_hyv    = "Microsoft Hv" ascii wide
        $cpuid_kvm    = "KVMKVMKVM" ascii wide
        $cpuid_xen    = "XenVMMXenVMM" ascii wide
        $cpuid_bhyve  = "bhyve bhyve" ascii wide
        $cpuid_qnx    = "QNXQVMBSQG" ascii wide

                        
        $rdtsc         = { 0F 31 }          $timing_api1   = "GetTickCount" ascii wide nocase
        $timing_api2   = "GetTickCount64" ascii wide nocase
        $timing_api3   = "QueryPerformanceCounter" ascii wide nocase
        $timing_api4   = "QueryPerformanceFrequency" ascii wide nocase
        $timing_api5   = "timeGetTime" ascii wide nocase
        $timing_api6   = "NtQuerySystemTime" ascii wide nocase
        $timing_sleep  = "NtDelayExecution" ascii wide nocase

                        
        $wmi1  = "SELECT * FROM Win32_ComputerSystem" ascii wide nocase
        $wmi2  = "SELECT * FROM Win32_BIOS" ascii wide nocase
        $wmi3  = "SELECT * FROM Win32_BaseBoard" ascii wide nocase
        $wmi4  = "SELECT * FROM Win32_DiskDrive" ascii wide nocase
        $wmi5  = "SELECT * FROM Win32_PhysicalMemory" ascii wide nocase
        $wmi6  = "SELECT * FROM Win32_Processor" ascii wide nocase
        $wmi7  = "SELECT * FROM Win32_NetworkAdapterConfiguration" ascii wide nocase
        $wmi8  = "SELECT * FROM Win32_Fan" ascii wide nocase
        $wmi9  = "SELECT * FROM Win32_TemperatureProbe" ascii wide nocase
        $wmi10 = "SELECT * FROM Win32_PortConnector" ascii wide nocase
        $wmi11 = "Win32_VideoController" ascii wide nocase
        $wmi12 = "root\\SecurityCenter2" ascii wide nocase
        $wmi13 = "AntiVirusProduct" ascii wide nocase
        $wmi14 = "root\\cimv2" ascii wide nocase

                        
        $adbg1 = "IsDebuggerPresent" ascii wide nocase
        $adbg2 = "CheckRemoteDebuggerPresent" ascii wide nocase
        $adbg3 = "NtQueryInformationProcess" ascii wide nocase
        $adbg4 = "OutputDebugStringA" ascii wide nocase
        $adbg5 = "NtSetInformationThread" ascii wide nocase
        $adbg6 = "GetSystemInfo" ascii wide nocase
        $adbg7 = "GlobalMemoryStatusEx" ascii wide nocase
        $adbg8 = "NtQuerySystemInformation" ascii wide nocase

                        
                $usr1  = "sandbox" ascii wide nocase
        $usr2  = "virus" ascii wide nocase
        $usr3  = "malware" ascii wide nocase
        $usr4  = "maltest" ascii wide nocase
        $usr5  = "currentuser" ascii wide nocase
        $usr6  = "Wilber" ascii wide nocase
        $usr7  = "Peter Wilson" ascii wide nocase
        $usr8  = "John" ascii wide nocase
        $usr9  = "Emily" ascii wide nocase
        $usr10 = "SANDBOX" ascii wide

                $host1 = "DESKTOP-" ascii wide nocase
        $host2 = "TEQUILABOOMBOOM" ascii wide nocase
        $host3 = "SANDBOX" ascii wide nocase
        $host4 = "7SILVIA" ascii wide nocase
        $host5 = "JOHN-PC" ascii wide nocase

                $env1  = "GetEnvironmentVariable" ascii wide nocase
        $env2  = "GetComputerName" ascii wide nocase
        $env3  = "GetUserName" ascii wide nocase
        $env4  = "GetVolumeInformation" ascii wide nocase

                $disk1 = "GetDiskFreeSpaceEx" ascii wide nocase
        $disk2 = "DeviceIoControl" ascii wide nocase

                        
                $sbx1  = "wireshark.exe" ascii wide nocase
        $sbx2  = "procmon.exe" ascii wide nocase
        $sbx3  = "procexp.exe" ascii wide nocase
        $sbx4  = "ollydbg.exe" ascii wide nocase
        $sbx5  = "idaq.exe" ascii wide nocase
        $sbx6  = "x64dbg.exe" ascii wide nocase
        $sbx7  = "fiddler.exe" ascii wide nocase
        $sbx8  = "autoruns.exe" ascii wide nocase
        $sbx9  = "filemon.exe" ascii wide nocase
        $sbx10 = "regmon.exe" ascii wide nocase
        $sbx11 = "processhacker.exe" ascii wide nocase

                $sbxdll1 = "SbieDll.dll" ascii wide nocase                 $sbxdll2 = "dbghelp.dll" ascii wide nocase
        $sbxdll3 = "api_log.dll" ascii wide nocase                  $sbxdll4 = "dir_watch.dll" ascii wide nocase                $sbxdll5 = "snxhk.dll" ascii wide nocase                    $sbxdll6 = "cmdvrt32.dll" ascii wide nocase                 $sbxdll7 = "cmdvrt64.dll" ascii wide nocase                 $sbxdll8 = "pstorec.dll" ascii wide nocase          
                        
        $res1  = "NumberOfProcessors" ascii wide nocase
        $res2  = "GetLogicalProcessorInformation" ascii wide nocase
        $res3  = "SYSTEM_INFO" ascii wide nocase
        $res4  = "dwNumberOfProcessors" ascii wide nocase
        $res5  = "TotalPhysicalMemory" ascii wide nocase
        $res6  = "ullTotalPhys" ascii wide nocase

                        
                $vmio1 = { BA 58 56 00 00 ED }                     $vmio2 = { B8 58 56 4D 58 BA 58 56 }               $vmio3 = { 66 BA 58 56 ED }                 
                        
        $sleep1 = "Sleep" ascii wide nocase
        $sleep2 = "SleepEx" ascii wide nocase
        $sleep3 = "WaitForSingleObject" ascii wide nocase
        $sleep4 = "NtDelayExecution" ascii wide nocase
        $sleep5 = "SetTimer" ascii wide nocase
        $sleep6 = "CreateTimerQueueTimer" ascii wide nocase

                        
        $uichk1 = "GetCursorPos" ascii wide nocase
        $uichk2 = "GetAsyncKeyState" ascii wide nocase
        $uichk3 = "GetForegroundWindow" ascii wide nocase
        $uichk4 = "GetLastInputInfo" ascii wide nocase
        $uichk5 = "EnumWindows" ascii wide nocase
        $uichk6 = "GetDesktopWindow" ascii wide nocase
        $uichk7 = "SystemParametersInfoA" ascii wide nocase

    condition:
        pe.is_pe and

                                (
                        (
                ( 2 of ($reg_vmw*) ) or
                ( 2 of ($reg_vbx*) ) or
                ( 2 of ($reg_hyv*) ) or
                ( 2 of ($reg_xen*) ) or
                ( 1 of ($reg_qmu*) and 1 of ($hw_qmu*) )
            )
            or

                        (
                ( 2 of ($file_vmw*) ) or
                ( 2 of ($file_vbx*) ) or
                ( 1 of ($file_hyv*) and 1 of ($file_prl*) ) or
                ( 1 of ($file_qmu*) ) or
                ( 1 of ($file_xen*) )
            )
            or

                        (
                ( $cpuid_op or $cpuid_leaf ) and
                ( 1 of ($cpuid_vmw, $cpuid_vbx, $cpuid_hyv, $cpuid_kvm, $cpuid_xen, $cpuid_bhyve, $cpuid_qnx) )
            )
            or

                        ( 1 of ($vmio*) )
            or

                        (
                2 of ($wmi*) and
                ( 1 of ($hw_vmw*) or 1 of ($hw_vbx*) or 1 of ($hw_hyv*) or 1 of ($hw_qmu*) or 1 of ($hw_xen*) or $hw_kvmx or $hw_wine )
            )
            or

                        (
                ( $rdtsc or $timing_sleep ) and
                2 of ($timing_api*)
            )
            or

                        (
                ( 3 of ($sbx*) ) or
                ( 2 of ($sbxdll*) ) or
                ( 1 of ($sbx*) and 1 of ($sbxdll*) )
            )
            or

                        (
                ( 2 of ($usr*) or 2 of ($host*) ) and
                2 of ($env*)
            )
            or

                        (
                ( $disk1 or $disk2 ) and
                ( 1 of ($env*) or 1 of ($res*) )
            )
            or

                        (
                2 of ($res*) and
                ( 1 of ($adbg*) or 1 of ($wmi*) )
            )
            or

                        (
                3 of ($uichk*) and
                2 of ($sleep*)
            )
            or

                        (
                2 of ($mac_vmw, $mac_vmw2, $mac_vbx, $mac_hyv, $mac_xen, $mac_prl)
            )
            or

                                    (
                ( 1 of ($reg_vmw*, $reg_vbx*, $reg_hyv*, $reg_xen*, $reg_qmu*) ) and
                ( 1 of ($file_vmw*, $file_vbx*, $file_hyv*, $file_prl*, $file_qmu*, $file_xen*) ) and
                ( 1 of ($hw_vmw*, $hw_vbx*, $hw_hyv*, $hw_qmu*, $hw_xen*, $hw_kvmx, $hw_wine) )
            )
        )
        and

                        
                pe.number_of_sections > 0

        and

                for any i in (0..pe.number_of_sections - 1): (
            pe.sections[i].raw_data_size > 4096 and
            math.entropy(pe.sections[i].raw_data_offset, pe.sections[i].raw_data_size) >= 6.5
        )

        and

                (
            pe.imports("kernel32.dll", "IsDebuggerPresent") or
            pe.imports("kernel32.dll", "GetSystemInfo") or
            pe.imports("kernel32.dll", "GlobalMemoryStatusEx") or
            pe.imports("kernel32.dll", "GetTickCount") or
            pe.imports("kernel32.dll", "GetTickCount64") or
            pe.imports("kernel32.dll", "QueryPerformanceCounter") or
            pe.imports("kernel32.dll", "Sleep") or
            pe.imports("kernel32.dll", "GetVolumeInformationA") or
            pe.imports("kernel32.dll", "GetVolumeInformationW") or
            pe.imports("kernel32.dll", "GetComputerNameA") or
            pe.imports("kernel32.dll", "GetComputerNameW") or
            pe.imports("kernel32.dll", "GetDiskFreeSpaceExA") or
            pe.imports("kernel32.dll", "DeviceIoControl") or
            pe.imports("advapi32.dll", "GetUserNameA") or
            pe.imports("advapi32.dll", "GetUserNameW") or
            pe.imports("advapi32.dll", "RegOpenKeyExA") or
            pe.imports("advapi32.dll", "RegOpenKeyExW") or
            pe.imports("advapi32.dll", "RegQueryValueExA") or
            pe.imports("advapi32.dll", "RegQueryValueExW") or
            pe.imports("ntdll.dll", "NtQueryInformationProcess") or
            pe.imports("ntdll.dll", "NtQuerySystemInformation") or
            pe.imports("user32.dll", "GetCursorPos") or
            pe.imports("user32.dll", "GetLastInputInfo") or
            pe.imports("user32.dll", "EnumWindows") or
            pe.imports("ole32.dll", "CoCreateInstance") or
            pe.imports("oleaut32.dll", "SysAllocString")
        )
}
[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

8b008502-1c20-4394-bce9-3978f816d7af
Propose edits, view related rules, and engage with the community through comments.
Executable code, not a declarative rule
This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.
Rejected pattern present
[[ reason ]]
What does this mean?
Format & documentation suggestions
Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.
[[ reason ]]
What do these messages mean?
[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion
