How to know if you have downloaded a malware on a virtual machine [duplicate]

Question

First, I'm a complete beginner, my only experience in malware is running windows defender lol. But I will try my best to learn anything that you guys recommend.

My younger brother keeps downloading games from shady websites, thankfully till now he hasn't gotten a virus from any of them. I wanted to teach him why it's unsafe to do this by doing the same, but on a virtual machine and showing him how they can be infected with malware, and also why malware is bad. I was thinking of just using VirtualBox, but if any of you have any other suggestions then I can look into more options as well!

So, how can I show him that the game I downloaded on the virtual machine came with malware?

Also, this is just paranoid me talking, but I saw somewhere that viruses can infect main systems even if i run them on virtual box? I'll be doing this on my main laptop so i really cannot risk getting a virus on it, so just wanted to confirm.

Answer 1

Installing actual malware as a beginner sounds like a very bad idea. Virtual machines can provide some level of isolation, but only if they're properly configured and hardened. By default, there are countless ways for how the VM can interact with the host (or other machines): through the network, through shared folders, through devices of the host (e. g. USB sticks). Unless you'rea taking all that into account, malware can cause a lot of damage even when it's seemingly isolated in a VM.

Besides that, malware is typically meant to be difficult to detect, so there won't be any spectacular effects to be seen -- ransomware being an exception.

I think a much better approach is to create your own toy “malware” which has some annoying but harmless effects. For example, display a message and make the screen flicker for a while. On Windows, you should be able to do this with PowerShell.