Anti virus avoidance

From Grayhat cheatsheets
Jump to navigationJump to search

Most antivirus softwares use blacklists, and examine files looking for pieces of known malicious codes. It may be possible to trick an antivirus by changing some of these strings, but it may be difficult to change all. Sometimes it is a matter of trial and error.

In Kali linux there are helpful tools. We can update to www.virustotal.com our modified files, to see how successful they are in fooling different antiviruses.

A payload generated with msfvenom can be encoded several times, for example with the shikata_ga_nai encoder, to reduce the number of antivirus engines capable of detecting it. This doesn't always help, and we can also try to embed the payload in a legit executable file, which will bypass some antiviruses. For this, in shikata_ga_nai we need to use the option -x /filepath/filename, to embed it there.

Some companies obfuscate their software binaries to prevent reverse engineering. We can use these obfuscating tools to obfuscate our exploits. One such program is Hyperion, available in Kali, for 32 bit binaries.   We extract it from the windows binaries folder, and compile it with i586-mingw32msvc-g++ Src/Crypter/*cpp -o hyperion.exe

and we run it with: -code>wine hyperion.exe file.exe   We can create our own trojans, which very unlikely will be detected by antivirus, since they use new code. If we use python, for example, we can compile it with pyinstaller. In any case, always check first in antivirus total or similar.