Antivirus Aversion Techniques

[jamesjamesbond]

Like many of you I have spent tons of time reading through GitHub, using Google Translate to decipher Russian, and pretty much going down one dead end after another. Here are some things I have learned. Hopefully this helps someone here.

#1 lesson I have learned is a good Crypt is important, but without a well formatted file and source code is worthless.

​

Here are some things I did that drastically improved my detections.

1. Keywords Matter
At the start I was guilty of doing things like naming my stub "crypt 1", or "test1" or some kind of word that signaled to everyone I was "up to something".
2. Location Matters
Having my stub sitting in a subfolder named Metasploit, which resided in a folder named Hacking Scripts was ultimately not doing me any good. Once I started naming my folders things like "weekend at the lake" or "Bob and Joe", or "fishing Trip" I immediately saw improvement.
3. Preparing the file matters

These next steps likely made the biggest different in detection rates.​

​

Stage 1 - Collection​

1. Download WinRAR and install it.
2. Create a folder far away from all of your scripts and name it something benign like "Grandma".
3. Inside of the "Grandma" directory create a new folder called "Birthday".
4. Download a photo and store the photo inside of the "Birthday" directory, name that photo anything you want.
5. Take that photo and find an online service that can convert it to a ICO file. Select 256X256 as the size. Store the ICO in the "Grandma" directory.
6. Wherever you got your .exe from, insert it in the "Birthday" directory.

Stage 2 - Configuration​

1. Hover over the "Birthday" folder and create a Rar archive. Choose compression method as Best.
2. Click the box that says Create SFX Archive.
3. Click on Advanced at the top, once you do that click on SFX... Options, then click on Setup.
4. In the setup box there is another box which says Run After Extraction. The first line should be your exe file, and directly under it should be your photo file.
5. Next you need to go to the Modes tab and check "Hide All"
6. The next tab is the Text and Icon tab. Here you need to set your path to your ICO file
7. Lastly go to the Update tab and select Extract and Update Files and select "Overwrite all Files"

Stage 3​

​

1. If you can add a certificate to your file its helpful.​

2. Click OK to archive the file.​

​

​

Hope this all helps!​

Click to read more...