How does malware detect virtual machines?

No video

How does malware detect virtual machines?

Рет қаралды 10,157

screeck

Күн бұрын

Пікірлер: 82

@VietnamENGLofichannel Ай бұрын

thx,now i can add those keys in my machine to defend against malwares

@badanamumcgamer Ай бұрын

Smart move my boy 🗿👍

@trenaxy9938 Ай бұрын

And not be able to run some games

@tails1154 Ай бұрын

thats what I was thinking lol

@aisultan3329 Ай бұрын

There is app that lets you do that @EricParker did this in his video

@YuraSamusenko Ай бұрын

"A person who thinks all the time"

@Jukebox300Minecraft Ай бұрын

I had no idea some malwares even did that. So devious lol.

@insomnicc1215 Ай бұрын

some? mostly all do, they just make it undetectable if you have a vm, and theres many diff ways too

@NotXiAnzheng Ай бұрын

for everyone saying i can add those key in my windows machine technically yes it can help you prevent some malware that check for those keys but you will get an error message if you try to run an app or program that doest want their code to be peeked at eg : Anticheat & some Paid Software its because those app and program thought your real machine was a virtual environment , you were trying to reverse engineer their app either you want to hack it or crack it Which why i dont recommend you guys add it in a real windows machine you guys just gonna having a bad time unless those machine was just used for a production stuff like databases or other server stuff (most of server and databases stuff wont detect those keys)

@tiikoni8742 Ай бұрын

So could you defend yourself from certain malwares just by creating those registry keys? :-)

@screeck Ай бұрын

Well, technically yes haha

@olokelo Ай бұрын

Yes, Eric Parker did a video about it :) kzbin.info/www/bejne/sIWyfHiBhp18iqM

@Margen67 Ай бұрын

Penguins need HUGS

@r3arie Ай бұрын

That's exactly what Cyber Scarecrow does (It's a program that makes your machine looks like a VM to prevent these types of malware)

@screeck Ай бұрын

@@r3arie yoo, this seems pretty cool. I'll check it out

@janicevilla10 Ай бұрын

I've heard some malware can even break out of VM's how do they do that?

@screeck Ай бұрын

From what I've heard this can be done if your virtualisation software has bugs or you have set up networking in a way that VM can connect to other machines. I haven't explored this topic yet so I can't tell much more.

@ricardoteixeira5436 Ай бұрын

Virtualization software 0 days, or it could be malware that exploits a certain services that you may be running on your machine and you misconfigured the network of the malware analysis VM. For example, if you were reversing a malware and you had a RDP vulnerable version to BlueKeep and that malware happens to exploit BlueKeep + you have not isolated your vm's network from your main network it will just jump from your VM from your machine

@NTSA-ox6fg Ай бұрын

Mostly networks connections, like if you have ur VM connected into your network, they can make it out by the network connection, like how worms do .

@hiddenavia Ай бұрын

So theoretically, I could make that keys and my pc will be malwareproof? (Semi)

@McBobX Ай бұрын

Exactly what I thought of lmao... Outsmarting scammers :)

@whereisyourhijab Ай бұрын

thanks bro for the information it will be very useful in my next malware.

@TheGamer2024Short Ай бұрын

Kay? Resoult?

@user-bi4eo3ys1f Ай бұрын

kay was fixed to key. Resoult might be any word.

@juozasdautartas8566 Ай бұрын

Is it possible to lets say hook those winAPI's and return them information that there are no such registry keys?

@abyssguardian Ай бұрын

I’m certain, but I don’t have a single clue about it

@CYBER-HERO Ай бұрын

There is another way is by checking the gpu. virtual machines GPUs is virtual and not named like any physical graphics card. How we're gonna defend ourselfs from this? By going to some keys in regeditor and edit the gpu name to a real one so the malware that have the gpu as a definer of real or virtual machines will just fall

@thatoneguy3_ Ай бұрын

Good video! But for me keybord sounds are a little to loud or maybe there is something wrong with me

@Margen67 Ай бұрын

Penguins need HUGS

@lPlanetarizado Ай бұрын

i have seen certain cracking tool checking for serial number of motherboard too (apparently most VMs software set the serial number to zero)

@TheTim2626 Ай бұрын

they do a lot of other things to detect VMs, like installed application (process hacker, IDA, ...), resolution, present users, disk size, process running, ... and there is not only virtual box (VMware, qemu, ...), so checking only this registry keys is really not enought

@IgaziArni9136 Ай бұрын

What if i use VMWare and run that code in VMWare?

@NTSA-ox6fg Ай бұрын

Is there any way to bypass this script? Like using fakenet or deleting these registrykeys from the VM?

@MLS-125 Ай бұрын

you can rename the reg values. im not really an expert on this topic but besides registry folders there might be other things malware detects in a vm in order for to recognize its being toy'd with. but try renaming it and let me know

@NTSA-ox6fg Ай бұрын

@@MLS-125 aight thank you

@rareshuminic8838 Ай бұрын

How did you learn all this?

@screeck Ай бұрын

I do research. I'll make a video on how to write yout first malware soon.

@jebtickle4065 Ай бұрын

Learn*

@gizmowizard352 Ай бұрын

@@screeck yeehaw!

@alitxlop 19 сағат бұрын

Wow. Where do you learn all of this stuff ?

@SeppyYT Ай бұрын

Use C99 or change extension to cpp and you can skip Declaring Variables at the start of the scope. It makes Code more readable if you need to check the type of Variable.

@ruycr4ft Ай бұрын

for vmware vms it'd work the same or the reg keys are the same?

@screeck Ай бұрын

No, they are not the same, but if you find reg keys for vmware, this method should work.

@EduardoEscarez Ай бұрын

Those are the Registry Keys for VirtualBox Guest Additions, an optional package of VirtualBox services you can install in the guest machine to communicate better with the host. I think in VMWare has something similar called VMWare Tools so the registry keys should be different.

@ruycr4ft Ай бұрын

@@screeck ye checked it and vmware key is SYSTEM\\CurrentControlSet\\Services\\vmhgfs (if someone is interested on it) if i have time i'll put in my github a repo about this that if it is a vm, does nothing and if it ain't a vm, gives a rev shell. I'll obviously thank to this video :P really nice project bro

@benhetland576 Ай бұрын

@@EduardoEscarez So then they aren't there unless you run a Windows client machine AND has installed the guest additions AND it is run under Virtual Box (on any host OS I suppose). The script kiddies might be tripped by this (and they are plentiful), but hardly any more serious malware. Those that use for example VMWare, Hyper-V (Windows host), KVM (Linux host) or others will not be "affected", but I think also there are more advanced ways to detect that one runs within a virtual machine.

@EduardoEscarez Ай бұрын

@@benhetland576 Yep, the guest environment needs to have the Additions (there are also versions for other OS) to have the keys in addition to be run under VirtualBox. And yes, there are other ways to detect if an OS is under virtualization (devices in the environment, CPU behavior, number of cores available, etc) but that's more tricky and Unix/Linux hosts can provide more ways to make a Windows guest more real.

@Tariaodk Ай бұрын

If malware detect files to see if it should run or not, can't we just add those files and we would be safe from malware attakes.

@senan9142 Ай бұрын

Some software won't work

@Tariaodk Ай бұрын

@@senan9142 oh okay, thanks

@rzm3663 Ай бұрын

What if main machine pretend to be VM?

@NightTerrorYT Ай бұрын

Yeah, but is a common technique, you need creativity to check some things that is not publicly available like the presents of a driver specific for VMs or something which is unique.

@auwa69 Ай бұрын

Would definitely love more videos on this topic

@fleecky7011 Ай бұрын

Very simple, short, easy and amateur way of detecting vm's this can be bypassed with ease. Next time come with something more sophisticated and advanced.