Defensive checks from Moker Trojan

moker_check.cpp

#include <Windows.h>
#include <stdio.h>

bool isVBox() 
{
	HKEY hKey = NULL;
	RegOpenKeyA(HKEY_LOCAL_MACHINE, "HARDWARE\\ACPI\\DSDT\\VBOX__", &hKey);
	if (hKey != NULL) {
		RegCloseKey(hKey);
		return true;
	}
	return false;
}

bool isTrusterRapportInstalled() 
{
	HKEY hKey = NULL;
	RegOpenKeyA(HKEY_CURRENT_USER, "Software\\Trusteer\\Rapport", &hKey);
	if (hKey != NULL) {
		RegCloseKey(hKey);
		return true;
	}
	return false;
}

int main()
{
	size_t score = 0;
	if (isVBox()) {
		printf("[+] VM detected by the key: HKLM\\HARDWARE\\ACPI\\DSDT\\VBOX__\n");
		score++;
	}
	if (isTrusterRapportInstalled()) {
		printf("[+] Truster Rapport detected by the key: HKCU\\Software\\Trusteer\\Rapport\n");
		score++;
	}
	printf("---\nTotal score: %d\n", score);
	if (score == 0) {
		printf("Clean!\n");
	} else {
		printf("Not clean!\n");
	}
	system("pause");
	return 0;
}