[Kryptc]

What would be a good way to detect a VM and/or sandboxie? Maybe even VT scans if possible?

[Accord]

This is a good read if you want to know the technique, https://www.cyberbit.com/blog/endpoint-s...explained/

[VisualSoft]

This is a good read if you want to know the technique, https://www.cyberbit.com/blog/endpoint-s...explained/

nice find, hop op can make working source from it.

[__Digital__]

What would be a good way to detect a VM and/or sandboxie? Maybe even VT scans if possible?

check this out and don't forget to call it in your program

https://pastebin.com/zAmFnNui

If virtual machine detected you can also tell it to do something.

[Kryptc]

Ill check it out and lyk!

[__Digital__]

Ill check it out and lyk!

if you need any help feel free to drop me a pm.

[Kryptc]

if you need any help feel free to drop me a pm.

Will do!

[Grooty]

Found on Russian-language forums

Code

namespace AntiVM
{
    using System;
    using System.Runtime.InteropServices;

    internal static class NativeMethods
    {
        [DllImport("kernel32.dll", BestFitMapping = false, CharSet = CharSet.Unicode)]
        internal static extern IntPtr GetModuleHandle(string lpModuleName);
    }
}

namespace AntiVM
{
    using System;
    using System.Collections.Generic;
    using System.Diagnostics;
    using System.Linq;
    using System.Management;
    using System.Windows.Forms;

    public static class CheckVirtual
    {
        /* Created r3xq1 */

        /// <summary>
        /// <b>Метод для проверки на запуск в среде RDP</b> (Remote Desktop Protocol)
        /// </summary>
        public static bool IsRdpAvailable => SystemInformation.TerminalServerSession == true;

        /// <summary>
        /// <b>Метод для проверки запуска в песочнице.</b>
        /// <para>Если исполняемый файл будет запущен внутри Песочницы то возвращяем <b>true</b> иначе <b>false</b></para>
        /// </summary>
        /// <returns><b>true</b> или <b>false</b></returns>
        public static bool SandBoxies => Process.GetProcessesByName("SbieCtrl").Length > 0 && NativeMethods.GetModuleHandle("SbieDll.dll") != IntPtr.Zero;

        /// <summary>
        /// <b>Метод для проверки Vmware. Inc на машине пользователя.</b>
        /// <para>Проходится по списку <b>VirtualNames</b> и если находит совпадения то возвращает <b>true</b> иначе <b>false</b></para>
        /// </summary>
        /// <returns><b>true</b> или <b>false</b></returns>
        public static bool CheckWMI()
        {
            var VirtualNames = new List<string>
            {
                "virtual", "vmbox", "vmware", "virtualbox", "box",
                "thinapp", "VMXh", "innotek gmbh", "tpvcgateway",
                "tpautoconnsvc", "vbox", "kvm", "red hat"
            };
            List<string> list = GetModelsAndManufactures();
            foreach (string spisok in list)
            {
                return VirtualNames.Contains(spisok); // true
            }
            return false;
        }

        /// <summary>
        /// <b>Метод для получения информации о Производителе и Модели машины на системе пользователя.</b>
        /// </summary>
        /// <returns>Возвращает Модель и Производителя компьютера.</returns>
        private static List<string> GetModelsAndManufactures()
        {
            var ModMan = new List<string>();
            try
            {
                using var searcher = new ManagementObjectSearcher(@"root\CIMV2", "SELECT * FROM Win32_ComputerSystem");
                using var items = searcher.Get().OfType<ManagementObject>().Where(p => p != null).FirstOrDefault();
                ModMan.Add(items["Manufacturer"]?.ToString().ToLower());
                ModMan.Add(items["Model"]?.ToString().ToLower());
            }
            catch { }
            return ModMan;
        }

        /// <summary>
        /// <b>Инициализатор проверки всех методов на наличие запуска в среде VMware</b> (Virtual Machine)
        /// </summary>
        /// <returns></returns>
        public static bool Inizialize() => SandBoxies || IsRdpAvailable || CheckWMI();
    }
}

namespace AntiVM
{
    using System;

    internal static class Program
    {
        [STAThread]
        public static void Main()
        {
            Console.Title = "Anti Virtual Machine - (VM)";

            if (CheckVirtual.Inizialize())
            {
                Console.WriteLine("Обнаружена виртуальная машина");
            }
            else
            {
                Console.WriteLine("Вы работаете на рабочей машине.");
            }

            Console.Read();
        }
    }
}

[Joseph Ducreux]

check mac address (vmare/virtual-box always use same MAC), check for debugger, check to see if CD/DVD drive is physically installed (vms dont), check HDD size 20+gb, and check for virtualbox related processes