# AV aversion tips
some of the stuff im making keeps popping hot. Any AV aversion and obfiscation tips.

var unreadAlerts = '1';
Welcome back, purely_cabbage. You last visited: Today, 06:36 AM Log Out
You have one unread private message from dkota titled Welcome to the Forum!
Pages (2): 1 2 Next »
New Reply

Threaded Mode AV aversion tips

heyTakka
Senior Member
Posts:
40
Threads:
16
Joined:
Feb 2023
Reputation:
55
Credits: 0.35€ [Donate]
View All
#1
02-13-2023, 05:31 AM
some of the stuff im making keeps popping hot. Any AV aversion and obfiscation tips.
UwU
PM Rate
Report
prince97
Administrator
Posts:
145
Threads:
36
Joined:
Feb 2023
Reputation:
49
Credits: 25.6€ [Donate]
View All
#2
02-13-2023, 12:25 PM

> heyTakka Wrote: some of the stuff im making keeps popping hot. Any AV aversion and obfiscation tips.

Assuming by `stuff` you mean ransomware, then adding intermittent encryption to it might aid in reducing detection.
If you have any questions, please PM dkota
PM Rate
Reply Quote //
Crystalian
prince97 is my mom
Posts:
7
Threads:
4
Joined:
Feb 2023
Reputation:
3
Credits: 5€ [Donate]
#3
02-13-2023, 01:46 PM
One tips,Malware has the big size.
PM Rate
Reply Quote // Report
heyTakka
Senior Member
Posts:
40
Threads:
16
Joined:
Feb 2023
Reputation:
55
Credits: 0.35€ [Donate]
View All
#4
02-13-2023, 03:27 PM

> prince97 Wrote:

> > heyTakka Wrote: some of the stuff im making keeps popping hot. Any AV aversion and obfiscation tips.

> Assuming by `stuff` you mean ransomware, then adding intermittent encryption to it might aid in reducing detection.

Some other stuff too but yes. thanks for tip ill see what i can do.
UwU
PM Rate
Reply Quote // Report
Zogg
Elite
Posts:
15
Threads:
1
Joined:
Mar 2023
Reputation:
11
Credits: 9.9€ [Donate]
#5
03-15-2023, 01:36 PM
Find a good crypter service. It will obfuscate your malware to the point that AV will not find it. As soon as some AV starts detecting your code you just run it though again.
PM Rate
Reply Quote // Report
nobro
Newbie
Posts:
4
Threads:
0
Joined:
Mar 2023
Reputation:
0
Credits: 5€ [Donate]
#6
03-26-2023, 02:22 AM
kljyhtgrfedfghnjkl;
PM Rate
Reply Quote // Report
TIMOTHYLINEN82
Active Member
Posts:
27
Threads:
0
Joined:
Mar 2023
Reputation:
0
Credits: 5€ [Donate]
#7
03-26-2023, 06:31 AM

> heyTakka Wrote: some of the stuff im making keeps popping hot. Any AV aversion and obfiscation tips.

LEMMECHECK
PM Rate
Reply Quote // Report
AderTodd9
Newbie
Posts:
1
Threads:
0
Joined:
Mar 2023
Reputation:
0
Credits: 5€ [Donate]
#8
03-29-2023, 07:48 AM
if not said yet...padding binaries in ridiculous way can cheat some av (crowdstrike and similar). 90MB +more can bypass some version of agent
PM Rate
Reply Quote // Report
Zogg
Elite
Posts:
15
Threads:
1
Joined:
Mar 2023
Reputation:
11
Credits: 9.9€ [Donate]
#9
03-30-2023, 01:28 PM

> AderTodd9 Wrote: if not said yet...padding binaries in ridiculous way can cheat some av (crowdstrike and similar). 90MB +more can bypass some version of agent

Good point. If you make the binary large enough they cannot upload it to virustotal.
PM Rate
Reply Quote // Report
namename
VIP
Posts:
2
Threads:
0
Joined:
Mar 2023
Reputation:
1
Credits: 6.6€ [Donate]
#10
03-30-2023, 02:52 PM

> heyTakka Wrote: some of the stuff im making keeps popping hot. Any AV aversion and obfiscation tips.

Perhaps try cutting out bits and pieces of what's "popping hot" until you find a more manageable subset of what's causing the unintended behaviour and then working on fixing that? Large encrypted sections can be suspicious, so writing a en/decrypt algo to spread out your encrypted first-stage across multiple sections, for instance? Also accessing specific APIs can trigger on Windows, so try to find work-arounds and the like?
Biggest thing is to not copy other folks' code. Do it yourself and develop incrementally.
This is getting a bit long-in-the-tooth, but here's a detailed breakdown of how windows defended used to work. It's a pdf:
https://i.blackhat.com/us-18/Thu-August-...ulator.pdf
PM Rate
Reply Quote // Report

« Next Oldest | Next Newest »

Pages (2): 1 2 Next »
New Reply

Quick Reply
Message Type your reply to this message here. Signature Disable Smilies | You have selected one or more posts to quote. Quote these posts now or deselect them.

- Subscribe to this thread

Users browsing this thread: purely_cabbage
var thread_deleted = "0"; if(thread_deleted == "1") { $("#quick_reply_form, .new_reply_button, .thread_tools, .inline_rating").hide(); $("#moderator_options_selector option.option_mirage").attr("disabled","disabled"); }