Test AVs Runtime/Scantime on VMs

Test AVs Runtime/Scantime on VMs - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Cryptography, Encryption, and Decryption (https://hackforums.net/forumdisplay.php?fid=126)
+---- Thread: Test AVs Runtime/Scantime on VMs (/showthread.php?tid=5922299)

Test AVs Runtime/Scantime on VMs - aerohacker - Dec 24, 2018

There's a lot of Runtime and Scantime sites with a Engine with Multiple Antivirus making it easy to test if the server is FUD Runtime/Scantine, but some distribute the samples to AntiVirus companies and those who say they do not distribute are never 100% sure.

So thinking about it if I create some Virtual Machines (5 ou 10) and install a different AV in each to test RT/ST, what precautions should I have for AVs don't istribute the samples?

Whenever I'll test the server, should I update the AV, disable the internet and only then copy the server to the VM?

RE: Test AVs Runtime/Scantime on VMs - Exodus - Dec 24, 2018

(Dec 24, 2018 10:34 AM)aerohacker Wrote: Whenever I'll test the server, should I update the AV, disable the internet and only then copy the server to the VM?

Correct.

RE: Test AVs Runtime/Scantime on VMs - CyberStrike - Dec 24, 2018

Use Snapshots instead of multiple VM's, also wait a couple of minutes after disabling internet before scanning. After you copy as well ensure that sharing is disabled.

RE: Test AVs Runtime/Scantime on VMs - NYANxCAT - Dec 24, 2018

I use snapshots http://prntscr.com/lz764w
Update AV then disable internet connection and just test your file.

RE: Test AVs Runtime/Scantime on VMs - Exodus - Dec 24, 2018

I just use snapshots too: Spoiler (Click to View)

RE: Test AVs Runtime/Scantime on VMs - Goldmouth - Mar 1, 2019

(Dec 24, 2018 07:26 PM)˗ˏˋ NYAN CAT ˎˊ˗ Wrote: I use snapshots http://prntscr.com/lz764w
Update AV then disable internet connection and just test your file.

(Dec 24, 2018 07:29 PM)Exodus Wrote: I just use snapshots too: Spoiler (Click to View)

Must be a more efficient way?

sorry for the dig

RE: Test AVs Runtime/Scantime on VMs - Exodus - Mar 3, 2019

(Mar 1, 2019 03:01 PM)⚠️️HOSTAH⚡ Wrote: Must be a more efficient way?

sorry for the dig

Not that I know off.

RE: Test AVs Runtime/Scantime on VMs - V3xD - Mar 4, 2019

The most efficent way is to install the av's command line tools onto the same install and to scan the file via command line, but that can be a bitch to setup. Also make sure you go into the antiviruses settings and disable the distribution of files- all avs have the option in the settings, and even if you disable your internet it may copy the file and wait until there is internet to upload it.

RE: Test AVs Runtime/Scantime on VMs - Lucifer Morningstar - Mar 5, 2019

(Mar 4, 2019 03:11 PM)V3xD Wrote: The most efficent way is to install the av's command line tools onto the same install and to scan the file via command line, but that can be a bitch to setup. Also make sure you go into the antiviruses settings and disable the distribution of files- all avs have the option in the settings, and even if you disable your internet it may copy the file and wait until there is internet to upload it.

That’s why you make a snapshot of a clean VM without networking and revert back to that snapshot when you’re done testing... Atleast that’s what I did on my service