I have found some software on 1337 that a friend was asking for. It’s for Windows and I’m on Linux. Is test running the software inside a VM the only way to securely vet it (to see what connections it tries to make and what processes it starts)? On VirusTotal, I get one positive and 66 negatives. Preferably, I’d like to hand over the software without worrying about giving them malicious code…

  • Mordikan@kbin.earth
    8·
    11 hours ago

    One thing to remember with VirusTotal is that it should only be used as a “tool of consensus”. A lot of AV solutions on their list will false flag binaries presumably to instill fear and get people to buy their solutions over more reputable AV providers. You want the AV that works the best which many people would equate to the most flagging (as logically incomplete as that may be).

    If you are seeing 66 flags and many of those being from reputable vendors, then I would say that what they show is likely accurate. Accuracy and relevance being two different things. 100% accuracy on keygen tools doesn’t mean that it is a relevant flag to what you’re trying to do.

    You could try software solutions like LOKI (the IoC scanner) or Azul to test specific binaries, though. I believe LOKI is just doing static analysis, but Azul I know automates the sandboxing.

    • frongt@lemmy.zipEnglish
      3·
      11 hours ago

      You can also put it through sandboxes like joesandbox or cuckoo to try to trigger and detect a payload. But some malware will expect this and not execute.

      Ultimately, judge your own risk tolerance by how much you trust the source, how much you want the software, what kind of systems protection you have in place (antivirus, antimalware, permissions control, backups), and how much you can afford to have your system compromised.

      • printf("%s", name);@piefed.blahaj.zoneOPEnglish
        1·
        7 minutes ago

        Ultimately, judge your own risk tolerance by how much you trust the source, how much you want the software, what kind of systems protection you have in place (antivirus, antimalware, permissions control, backups), and how much you can afford to have your system compromised. Thanks for this! I finally decided to hand the matter over to my friend, because vetting the binaries are just… a whole project on(in?) its own. I sent them exactly what you wrote, in addition to some concrete guidance on how to setup VMs, create backups, bootable media, whathaveyou.