[plugin_strings] Added a better rule for VMware detection through VMX…

…h magic value.
JusticeRage · Jan 24, 2020 · 69be7c7 · 69be7c7
1 parent 6874d50
commit 69be7c7
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/bin/yara_rules/suspicious_strings.yara b/bin/yara_rules/suspicious_strings.yara
@@ -578,7 +578,7 @@ rule VMWare_Detection : AntiVM
         author = "Cuckoo project"
 
     strings:
-        $a0 = "VMXh"
+        $a0 = { BA 58 56 00 00 ED 81 FB 68 58 4D 56 } // mov edx, 'VX'; in eax, dx; cmp ebx, 'VMXh'
         $a1 = "vmware" nocase wide ascii
         $vmware4 = "hgfs.sys" nocase wide ascii
         $vmware5 = "mhgfs.sys" nocase wide ascii