thx,now i can add those keys in my machine to defend against malwares
@badanamumcgamer
Ай бұрын
Smart move my boy 🗿👍
@trenaxy9938
Ай бұрын
And not be able to run some games
@tails1154
Ай бұрын
thats what I was thinking lol
@aisultan3329
Ай бұрын
There is app that lets you do that @EricParker did this in his video
@YuraSamusenko
Ай бұрын
"A person who thinks all the time"
@Jukebox300Minecraft
Ай бұрын
I had no idea some malwares even did that. So devious lol.
@insomnicc1215
Ай бұрын
some? mostly all do, they just make it undetectable if you have a vm, and theres many diff ways too
@NotXiAnzheng
Ай бұрын
for everyone saying i can add those key in my windows machine technically yes it can help you prevent some malware that check for those keys but you will get an error message if you try to run an app or program that doest want their code to be peeked at eg : Anticheat & some Paid Software its because those app and program thought your real machine was a virtual environment , you were trying to reverse engineer their app either you want to hack it or crack it Which why i dont recommend you guys add it in a real windows machine you guys just gonna having a bad time unless those machine was just used for a production stuff like databases or other server stuff (most of server and databases stuff wont detect those keys)
@tiikoni8742
Ай бұрын
So could you defend yourself from certain malwares just by creating those registry keys? :-)
@screeck
Ай бұрын
Well, technically yes haha
@olokelo
Ай бұрын
Yes, Eric Parker did a video about it :) kzitem.info/news/bejne/24qFsXmBimp6h3Y
@Margen67
Ай бұрын
Penguins need HUGS
@r3arie
Ай бұрын
That's exactly what Cyber Scarecrow does (It's a program that makes your machine looks like a VM to prevent these types of malware)
@screeck
Ай бұрын
@@r3arie yoo, this seems pretty cool. I'll check it out
@janicevilla10
Ай бұрын
I've heard some malware can even break out of VM's how do they do that?
@screeck
Ай бұрын
From what I've heard this can be done if your virtualisation software has bugs or you have set up networking in a way that VM can connect to other machines. I haven't explored this topic yet so I can't tell much more.
@ricardoteixeira5436
Ай бұрын
Virtualization software 0 days, or it could be malware that exploits a certain services that you may be running on your machine and you misconfigured the network of the malware analysis VM. For example, if you were reversing a malware and you had a RDP vulnerable version to BlueKeep and that malware happens to exploit BlueKeep + you have not isolated your vm's network from your main network it will just jump from your VM from your machine
@NTSA-ox6fg
Ай бұрын
Mostly networks connections, like if you have ur VM connected into your network, they can make it out by the network connection, like how worms do .
@hiddenavia
Ай бұрын
So theoretically, I could make that keys and my pc will be malwareproof? (Semi)
@McBobX
Ай бұрын
Exactly what I thought of lmao... Outsmarting scammers :)
@whereisyourhijab
Ай бұрын
thanks bro for the information it will be very useful in my next malware.
@TheGamer2024Short
Ай бұрын
Kay? Resoult?
@user-bi4eo3ys1f
Ай бұрын
kay was fixed to key. Resoult might be any word.
@juozasdautartas8566
Ай бұрын
Is it possible to lets say hook those winAPI's and return them information that there are no such registry keys?
@abyssguardian
Ай бұрын
I’m certain, but I don’t have a single clue about it
@CYBER-HERO
Ай бұрын
There is another way is by checking the gpu. virtual machines GPUs is virtual and not named like any physical graphics card. How we're gonna defend ourselfs from this? By going to some keys in regeditor and edit the gpu name to a real one so the malware that have the gpu as a definer of real or virtual machines will just fall
@thatoneguy3_
Ай бұрын
Good video! But for me keybord sounds are a little to loud or maybe there is something wrong with me
@Margen67
Ай бұрын
Penguins need HUGS
@lPlanetarizado
Ай бұрын
i have seen certain cracking tool checking for serial number of motherboard too (apparently most VMs software set the serial number to zero)
@TheTim2626
Ай бұрын
they do a lot of other things to detect VMs, like installed application (process hacker, IDA, ...), resolution, present users, disk size, process running, ... and there is not only virtual box (VMware, qemu, ...), so checking only this registry keys is really not enought
@IgaziArni9136
Ай бұрын
What if i use VMWare and run that code in VMWare?
@NTSA-ox6fg
Ай бұрын
Is there any way to bypass this script? Like using fakenet or deleting these registrykeys from the VM?
@MLS-125
Ай бұрын
you can rename the reg values. im not really an expert on this topic but besides registry folders there might be other things malware detects in a vm in order for to recognize its being toy'd with. but try renaming it and let me know
@NTSA-ox6fg
Ай бұрын
@@MLS-125 aight thank you
@rareshuminic8838
Ай бұрын
How did you learn all this?
@screeck
Ай бұрын
I do research. I'll make a video on how to write yout first malware soon.
@jebtickle4065
Ай бұрын
Learn*
@gizmowizard352
Ай бұрын
@@screeck yeehaw!
@alitxlop
Күн бұрын
Wow. Where do you learn all of this stuff ?
@SeppyYT
Ай бұрын
Use C99 or change extension to cpp and you can skip Declaring Variables at the start of the scope. It makes Code more readable if you need to check the type of Variable.
@ruycr4ft
Ай бұрын
for vmware vms it'd work the same or the reg keys are the same?
@screeck
Ай бұрын
No, they are not the same, but if you find reg keys for vmware, this method should work.
@EduardoEscarez
Ай бұрын
Those are the Registry Keys for VirtualBox Guest Additions, an optional package of VirtualBox services you can install in the guest machine to communicate better with the host. I think in VMWare has something similar called VMWare Tools so the registry keys should be different.
@ruycr4ft
Ай бұрын
@@screeck ye checked it and vmware key is SYSTEM\\CurrentControlSet\\Services\\vmhgfs (if someone is interested on it) if i have time i'll put in my github a repo about this that if it is a vm, does nothing and if it ain't a vm, gives a rev shell. I'll obviously thank to this video :P really nice project bro
@benhetland576
Ай бұрын
@@EduardoEscarez So then they aren't there unless you run a Windows client machine AND has installed the guest additions AND it is run under Virtual Box (on any host OS I suppose). The script kiddies might be tripped by this (and they are plentiful), but hardly any more serious malware. Those that use for example VMWare, Hyper-V (Windows host), KVM (Linux host) or others will not be "affected", but I think also there are more advanced ways to detect that one runs within a virtual machine.
@EduardoEscarez
Ай бұрын
@@benhetland576 Yep, the guest environment needs to have the Additions (there are also versions for other OS) to have the keys in addition to be run under VirtualBox. And yes, there are other ways to detect if an OS is under virtualization (devices in the environment, CPU behavior, number of cores available, etc) but that's more tricky and Unix/Linux hosts can provide more ways to make a Windows guest more real.
@Tariaodk
Ай бұрын
If malware detect files to see if it should run or not, can't we just add those files and we would be safe from malware attakes.
@senan9142
Ай бұрын
Some software won't work
@Tariaodk
Ай бұрын
@@senan9142 oh okay, thanks
@rzm3663
Ай бұрын
What if main machine pretend to be VM?
@NightTerrorYT
Ай бұрын
Yeah, but is a common technique, you need creativity to check some things that is not publicly available like the presents of a driver specific for VMs or something which is unique.
@auwa69
Ай бұрын
Would definitely love more videos on this topic
@fleecky7011
Ай бұрын
Very simple, short, easy and amateur way of detecting vm's this can be bypassed with ease. Next time come with something more sophisticated and advanced.
@wziontek441
Ай бұрын
przyjemnie się ogląda, pozdro
@screeck
Ай бұрын
Pozdro
@Pawlo370
Ай бұрын
how to pack project into one exe file?
@olokel0347
Ай бұрын
Awesome video, keep it up! OMG you're also from Poland :)
@johnnyhamilton-xr6ep
Ай бұрын
more blue team strategy
@Jgc7
Ай бұрын
It's more easy to detect if a proccess is running.
@DASD934
Ай бұрын
Now you don't have to scan the thing for malware, just put and run it under vm, lol.
@rareshuminic8838
Ай бұрын
Thank you for the video!
@aeuludag
Ай бұрын
Nice posters dude :D
@crazycat1380
Ай бұрын
resoult
@benhetland576
Ай бұрын
Please doun't insoult us, ok?
@JesseWx_
Ай бұрын
Everyone just switch to a Virtual Machine :)
@dkkogmaw1311
18 күн бұрын
its prob the most easy way to bypass XD
@arthurmorgan2774
Ай бұрын
Długo już się uczysz informatyki? Po akcencie słychać, że jesteś Polakiem haha
@screeck
Ай бұрын
No pare lat już będzie, ale z różną intensywnością. Przez ostatni rok chyba najwięcej
@arthurmorgan2774
Ай бұрын
@@screeck Oki. A uczysz się z podręczników czy raczej tylko internet?
@screeck
Ай бұрын
@@arthurmorgan2774 Głównie z internetu. Ale są też fajne książki na przykład Windows Internals part1 o architekturze winodwsa
Пікірлер: 82