+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Cryptography, Encryption, and Decryption (https://hackforums.net/forumdisplay.php?fid=126)
+---- Thread: Build a AntiVirus VMs to test FUD servers (/showthread.php?tid=6285836)
Build a AntiVirus VMs to test FUD servers - aerohacker - Dec 2, 2024
I'm think to build some Windows Virtual Machines and install AntiVirus in each guest to test FUD servers in Realtime/Scantime.
1) What is better?! VirtualBox or VMWare?!
2) Which and how many AntiVirus it's be good to start?! I think about 10 AVs.
3) After copy and execute the server, would be better update the AV and disconnect the VM from Internet to avoid the AV share the stub?!
RE: Build a AntiVirus VMs to test FUD servers - DramaKing - Dec 2, 2024
(Dec 2, 2024 06:52 AM)aerohacker Wrote: I'm think to build some Windows Virtual Machines and install AntiVirus in each guest to test FUD servers in Realtime/Scantime.
1) What is better?! VirtualBox or VMWare?!
2) Which and how many AntiVirus it's be good to start?! I think about 10 AVs.
3) After copy and execute the server, would be better update the AV and disconnect the VM from Internet to avoid the AV share the stub?!
VMware Workstation is free now, so you should consider that.
That is a lot of VMs.
Turning off sample submission is better for the most accurate results without reporting.
RE: Build a AntiVirus VMs to test FUD servers - Bastille - Dec 2, 2024
That's an interesting topic but I don't think that's as simple as that, it's usually not recommended to install more than 1 AV on a computer, or at least to have them all active at the same time because they work on the same spaces and there is a chance to get errors / conflicts.
Besides, nowadays many malware have anti-VM detection, which means that you need to custom your VM to obfuscate every artifact related to virtualization (machine name, services, drivers, and so on ...)
I know that some people of HF worked on alternative of Kleenscans and so on, maybe they could share some info
RE: Build a AntiVirus VMs to test FUD servers - aerohacker - Dec 2, 2024
(Dec 2, 2024 07:00 AM)Bastille Wrote: That's an interesting topic but I don't think that's as simple as that, it's usually not recommended to install more than 1 AV on a computer, or at least to have them all active at the same time because they work on the same spaces and there is a chance to get errors / conflicts.
Besides, nowadays many malware have anti-VM detection, which means that you need to custom your VM to obfuscate every artifact related to virtualization (machine name, services, drivers, and so on ...)
I know that some people of HF worked on alternative of Kleenscans and so on, maybe they could share some info
1 VM to each AV (It would be separated)
The servers are mine so my intention is only to scan in realtime and scantime without to need any sites and avoid the same share the stub, and i won't use any anti in the server.
RE: Build a AntiVirus VMs to test FUD servers - aerohacker - Dec 2, 2024
(Dec 2, 2024 07:09 AM)m0hx Wrote: no. 1 VM and multiple snapshots to different AVs i think is better to save u resources.
Yeah, I'm think about to test most popular and best AntiVirus, but I think some AVs shared the same engine.
RE: Build a AntiVirus VMs to test FUD servers - aerohacker - Dec 2, 2024
(Dec 2, 2024 07:29 AM)m0hx Wrote: yea, i think AVG, Avast have same engine.
When a server is FUD, It doesn't matter if the AntiVirus it's default or set to maximum, the server will bypass anyway?!
RE: Build a AntiVirus VMs to test FUD servers - DramaKing - Dec 2, 2024
(Dec 2, 2024 07:29 AM)m0hx Wrote: yea, i think AVG, Avast have same engine.
I checked to verify. Norton owns Avast, and Avast owns AVG.
(Dec 2, 2024 07:36 AM)aerohacker Wrote: When a server is FUD, It doesn't matter if the AntiVirus it's default or set to maximum, the server will bypass anyway?!
Just check for the 'set to maximum' setting. 😜
RE: Build a AntiVirus VMs to test FUD servers - aerohacker - Dec 2, 2024
(Dec 2, 2024 07:29 AM)m0hx Wrote: yea, i think AVG, Avast have same engine.
Avast bought AVG and both use the same engine and even the GUI is similar.
RE: Build a AntiVirus VMs to test FUD servers - darkterror - Dec 3, 2024
(Dec 2, 2024 06:52 AM)aerohacker Wrote: I'm think to build some Windows Virtual Machines and install AntiVirus in each guest to test FUD servers in Realtime/Scantime.
1) What is better?! VirtualBox or VMWare?!
2) Which and how many AntiVirus it's be good to start?! I think about 10 AVs.
3) After copy and execute the server, would be better update the AV and disconnect the VM from Internet to avoid the AV share the stub?!
1. Doesn't really matter, for testing purposes of samples both are sufficient, for me it comes really to user experience. (Using Oracle VM)
2. Well focus mainly on AVs you need to penetrate and which are most common. Usually from what i saw people use ootb WD (might be wrong here) or "free ones" like AVG, Avira, Avast. I would suggest to check this annual report https://www.security.org/antivirus/antivirus-consumer-report-annual/ for more information
![[Image: t2vqhU8.png]](https://i.imgur.com/t2vqhU8.png)
10 vm with 10 avs is quite useless, i would use one of the scanning services like https://scanner.to/ or check forum, there are other sites available as well, its not that expensive and it saves you a lot of time, but if you are developer, than i would go for it.
3. Well, this is very hard question to answer, because some AVs collect data from scanning/detections even when you turn off sample submission. (referring to AVG in this case) more info here: https://businesshelp.avg.com/Content/Products/AVG_Antivirus/AntivirusManagement/ConfiguringPrivacySettings.htm
3.1 You could turn off the internet to test the sample, but you would loose Cloud Based Detections which are quite strong these days so your results would be "inaccurate".
RE: Build a AntiVirus VMs to test FUD servers - Donrulezz - Dec 31, 2024
Based on my experience, I have observed the following:
Instead of installing multiple antivirus programs, especially for runtime scan, I recommend installing Comodo Firewall and Antivirus. You can perform a scan in runtime mode.
If the scan bypasses Comodo, it is likely to bypass all other antivirus programs in runtime as well, as, to the best of my knowledge, Comodo is the strongest in runtime detection.
RE: Build a AntiVirus VMs to test FUD servers - DramaKing - Dec 31, 2024
(Dec 31, 2024 09:47 AM)Donrulezz Wrote: Based on my experience, I have observed the following:
Instead of installing multiple antivirus programs, especially for runtime scan, I recommend installing Comodo Firewall and Antivirus. You can perform a scan in runtime mode.
If the scan bypasses Comodo, it is likely to bypass all other antivirus programs in runtime as well, as, to the best of my knowledge, Comodo is the strongest in runtime detection.
Based on its static detection, I am very surprised.
RE: Build a AntiVirus VMs to test FUD servers - 7 - Dec 31, 2024
QubesOS is great though for type 1 virtualisation just build the Qube and clone for multiple AV's
I personally love Qubes but you need the spec