[Vittlesical]

I've implemented a method to check if my malware is running in a virtual machine (VM). This helps in detecting if the malware is being analyzed, as most analysts use sandboxing or VM environments to observe malware behavior.

1 - What is Anti-VM ?
Anti-VM (anti-virtual machine) techniques are methods employed by software, particularly malware, to detect the presence of a virtualized environment and alter its behavior accordingly.

2 - Method used in my code ?

CPUID Instruction:

• Malware can use the
  cpuid which is an instruction used to check for known VM-specific vendor strings (e.g., "VMwareVMware", "VBoxVBoxVBox", "Microsoft Hv", "TCGTCGTCGTCG").
  

photo:


the source code is right here:

Hidden Content

You must register or login to view this content.

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: See you on the other side.

[mcch]

cool, ima use this shit for my stealer

[Vittlesical]

cool, ima use this shit for my stealer

if you upload it to  virustotal youre gay

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: See you on the other side.

[xzin0vich]

Also for some VM the Mac adresse is like 050 smth

[Vittlesical]

Also for some VM the Mac adresse is like 050 smth

the implementation works on "VMwareVMware", "VBoxVBoxVBox", "Microsoft Hv(Microsoft Hypervisor)", "TCGTCGTCGTCG(qemu)"
i've never tried Mac tbh.

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: See you on the other side.

[stevenPeter]

Thanks for the technique.

[saul-notbadman]

I heard about a neet method used in anti-cheats that relies on cpu execution timing. Have you used this before?
This method is undefeatable too allegedly.

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Scamming

[Vittlesical]

I heard about a neet method used in anti-cheats that relies on cpu execution timing. Have you used this before?
This method is undefeatable too allegedly.

i've heard of it but never tried it and its called Timing-based anti-cheat detection and it has bunch of techniques one of them called BaseLine Timing Profiles, which basically the system establishes a baseline of normal execution times for various operations and processes in the game.

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: See you on the other side.

[Kyrie]

i've heard of it but never tried it

Better that way, it's unreliable since it's usually implemented using TSC along cpuid or such, which can lead to different result depending on the hypervisor, leaf, CPU or even vmcs configuration.

[Zarif]

Thanks very much