[nymph_mmxm]

Does anybody know any basic anti analysis techniques? Like anti-sandbox and anti-vm so that my software does not get run through sandboxes and it shows a bad result.

[DramaKing]

Hostname checking is one method.

[Bastille]

The first step should be to check the environment (fingerprints) with things such as :

- MAC addresses of network cards (00:05:69 for VMware, etc.)
- BIOS version / manufacturer strings ("VirtualBox", "VMware", etc.)
- CPU features (hypervisor bit enabled)
- Hard drive serial numbers ("VBOX", "VMWARE")
- Presence of VM tools (VMware Tools, VBoxGuest additions)
- Special device drivers linked to virtualization
- Screen resolution typical of VMs (like 800x600)
- Low number of CPU cores
- Low memory (like 1 GB RAM)
- Running processes typical of sandboxes (sandbox.exe, cuckoomon.exe, etc.)

This will work in most of cases, but probably not in advanced environments. But this is a good start point

[nymph_mmxm]

The first step should be to check the environment (fingerprints) with things such as :

- MAC addresses of network cards (00:05:69 for VMware, etc.)
- BIOS version / manufacturer strings ("VirtualBox", "VMware", etc.)
- CPU features (hypervisor bit enabled)
- Hard drive serial numbers ("VBOX", "VMWARE")
- Presence of VM tools (VMware Tools, VBoxGuest additions)
- Special device drivers linked to virtualization
- Screen resolution typical of VMs (like 800x600)
- Low number of CPU cores
- Low memory (like 1 GB RAM)
- Running processes typical of sandboxes (sandbox.exe, cuckoomon.exe, etc.)

This will work in most of cases, but probably not in advanced environments. But this is a good start point

Thank you very much for the help!

[Bastille]

Thank you very much for the help!

You're welcome, my little scammer