# ayoubfaouzi/al-khaser

Public malware techniques used in the wild: Virtual Machine, Emulation, Debuggers, Sandbox detection.

Repository: https://github.com/ayoubfaouzi/al-khaser
Canonical: https://ross.abutalabs.com/products/al-khaser
Language: C++
License: GPL-2.0
License Family: copyleft
Topics: anti-analysis, anti-debugging, anti-sandbox, anti-vm, anti-emulation, code-injection, malware, timing-attacks, av-bypass, sandbox-evasion, anti-disassembly
Last push: 2026-07-01T08:04:20+00:00

## Health v2 (maintenance only)
Score: 73/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 90, release rhythm 36, longevity 100
- inputs: {"age_days": 3947, "days_push": 63, "days_rel": 218, "gap_med": 492, "n_releases_24m": 2}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 7108, forks 1255 (observed 2026-08-28T04:09:55.948289+00:00)

## What it is
Al-Khaser is a proof-of-concept Windows application that demonstrates a wide range of malware anti-analysis techniques, including anti-debugging, anti-VM, anti-sandbox, timing attacks, and code injection. It is intended to stress-test anti-malware systems and verify that analysis environments are properly hidden.

## Use cases
- test whether my sandbox solution is detectable by malware
- verify my anti-debugging plugin is effective
- check if my malware analysis VM is well hidden
- stress test antivirus detection of common malware tricks
- demonstrate anti-VM and anti-emulation techniques
- evaluate sandbox evasion via timing attacks

## When to choose
- you build or harden sandboxes, VMs, or anti-malware tooling and need a comprehensive test suite of evasion techniques
- you research or teach malware anti-analysis behavior on Windows

## When to avoid
- you need a real defensive tool that detects or blocks malware
- you want a cross-platform or non-Windows testing tool
- you lack authorization to run evasion techniques in your environment

## Facets
- artifact type: application
- maturity: active
- function: security, penetration-testing, vulnerability-scanning
- domain: security, penetration-testing, reverse-engineering
- platform: windows, cpp
- tags: anti-analysis, anti-debugging, anti-vm, anti-sandbox, malware-techniques, poc, av-testing

## Member repositories
- ayoubfaouzi/al-khaser (main) score 73

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:09:55.948289+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T17:40:07.626857+00:00, confidence not recorded.
  - readme: https://github.com/ayoubfaouzi/al-khaser (fetched 2026-08-28T04:09:55.948289+00:00, sha beec8666d8dc)
- Data as of 2026-08-30T08:39:29.467469+00:00.