+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Hacking Tools and Programs (https://hackforums.net/forumdisplay.php?fid=10)
+---- Thread: HELP | Anti-Analysis (/showthread.php?tid=6299323)
HELP | Anti-Analysis - nymph_mmxm - Jun 1, 2025
Does anybody know any basic anti analysis techniques? Like anti-sandbox and anti-vm so that my software does not get run through sandboxes and it shows a bad result.
RE: HELP | Anti-Analysis - DramaKing - Jun 1, 2025
Hostname checking is one method.
RE: HELP | Anti-Analysis - Bastille - Jun 1, 2025
The first step should be to check the environment (fingerprints) with things such as :
- MAC addresses of network cards (00:05:69 for VMware, etc.)
- BIOS version / manufacturer strings ("VirtualBox", "VMware", etc.)
- CPU features (hypervisor bit enabled)
- Hard drive serial numbers ("VBOX", "VMWARE")
- Presence of VM tools (VMware Tools, VBoxGuest additions)
- Special device drivers linked to virtualization
- Screen resolution typical of VMs (like 800x600)
- Low number of CPU cores
- Low memory (like 1 GB RAM)
- Running processes typical of sandboxes (sandbox.exe, cuckoomon.exe, etc.)
This will work in most of cases, but probably not in advanced environments. But this is a good start point
RE: HELP | Anti-Analysis - nymph_mmxm - Jun 1, 2025
(Jun 1, 2025 07:52 AM)Bastille Wrote: The first step should be to check the environment (fingerprints) with things such as :
- MAC addresses of network cards (00:05:69 for VMware, etc.)
- BIOS version / manufacturer strings ("VirtualBox", "VMware", etc.)
- CPU features (hypervisor bit enabled)
- Hard drive serial numbers ("VBOX", "VMWARE")
- Presence of VM tools (VMware Tools, VBoxGuest additions)
- Special device drivers linked to virtualization
- Screen resolution typical of VMs (like 800x600)
- Low number of CPU cores
- Low memory (like 1 GB RAM)
- Running processes typical of sandboxes (sandbox.exe, cuckoomon.exe, etc.)
This will work in most of cases, but probably not in advanced environments. But this is a good start point
Thank you very much for the help!
RE: HELP | Anti-Analysis - Bastille - Jun 1, 2025
(Jun 1, 2025 08:02 AM)nymph_mmxm Wrote: Thank you very much for the help!
You're welcome, my little scammer