Bypassing antivirus detection with encryption University of Piraeus Department of Digital Systems «Security of Digital Systems» Bypassing antivirus detection with encryption Tasiopoulos Vasilis Good afternoon I am Vasilis tasiopoulos and I am going to present you the research that I did during my master thesis with Mr Sokratis Katsika. The title is … Supervisor: Sokratis Katsikas

About Me Studied at University of Piraeus Currently working Informatics Security in Digital Systems Currently working KPMG as a IT Advisor and Penetration tester Before that I will say some things about me . I have studied at University of Piraeus in the department of informatics and then I did my master with title Security in Digital Systems in the department of digital systems. I am also certified with OSCP from Offencive Security and ISO27001 from TUV. Now I am currently working at KPMG as an IT advisor and especially as a penetration tester

Contents Related Research Background Knowledge-Antivirus Crypter Background Knowledge-Portable executable Background Knowledge-Portable Executable Loader RunPE and Injection Our Implementation Results Now lets start Here we can see the outline of this presentation .

Why? It is easier to change crypter It is harder to change ALL malwares Who can use it: Penetration Tests Anyone for Legitimate purpose There are a lot of times in my work as pentester that I must persuade someone that antivirus software does not provide ultimate security. So why we need Crypters . There are a lot of virus out there that antivirus can identify and we cannot use anymore. So … What if we could create something (I mean the crypter ) that can encrypt any malware and then if It gets identified by an antivirus we just need to change the crypter.

Related Research Implementation of Runtime Crypter by Christian Ammann Packing Heat by Dimitrios A. Glynos The Crypter BluePrint by crypters.net Several tutorial on HackForums.net Here we se related research in this subject that helped us in making our crypter.

Background Knowledge - Antivirus Signature-based detection: Traditionally, antivirus software heavily relied on signatures to identify malware. Heuristics: Another technique used in antivirus software is the use of heuristic analysis to identify new malware or variants of known malware. Real-time protection: Newer antivirus software also has another mechanism called “real time” protection. It is known that some (malicious) code may be hidden, encrypted, obfuscated or even created instantly. To be able to deal with such tricks antivirus packages are also capable of monitoring and intercepting API calls and of performing a kind of "behavioral analysis". So, if a well-known process acts in an unusual manner the antivirus will mark it as suspicious. Before we continue we must say some things about antivirus and the mechanisms that detect malwares just to know what we must evade. We have …. We also have …. And newer antivirous have an option called ….

Crypters: Types and behavior Runtime Scantime Options Internal Stub External Stub A Runtime Crypter encrypts the specified file and when executed (run), it is decrypted in memory. In this way antivirus packages are incapable of analyzing the file before and after execution. A Scantime Crypter encrypts the specified file so that antiviruses become unable to analyze the file only before executed, but NOT when executed. Crypter must: Encrypt

Crypter’s behavior Stub must: Decrypt Execute malware Stub options: Save in directory Load it in memory Load it in stub’s process Load in new process Inject into another process (optimal)

RunPE and Injection Method discovered by T.keong Injection: The stub is executed A new process is created in "suspended" state The Stub decrypts the malware The stub load the malware in the place of the suspended legitimate process The process is unsuspended. Limitation: 32 bit process or 64 bit process Not in both Different Implementations: Alternative way to call Apis Use of undocumented Apis But just loading the malware to the memory is not enought . It is better to inject the malware in a legitimate process. This can be done with a method discovered by T.Keong . The method follow the below steps : This method exist for many years and has been extensively used for crypters and malwares and thats why we need modify it in order to bypass antivirus. Alternative way to call Apis Use of undocumented Apis

Our Implementation Crypter’s Type Runtime Crypter External Stub Developed C# Visual Studio 2500 lines of code Encryption AES Sting pass to md5 >output 128 > pass to aes as key .

Architecture User Selects the malware Removing comments from stub Adding Hide code to stub (optional) Removing comments from stub Adding Fake message to stub (optional) Adding Junk Code to stub (optional) Adding Fake Apis to stub (optional) Add decompression code to stub (optional) Adding Addi-… code to stub (optional) Randomizing class, function, variable names and add them to stub and to RunPE Adding Encryption Key to stub User Selects the malware User configures the available options (optional) Crypter reads the malware byte per byte Encrypting malware Crypter reads the Stub Adding assembly info to stub (optional) Encrypting injection path Adding injection process path to stub Reading selected RunPE Adding startup code to stub (optional) We have included several options to our crypter . This options are the ones that are stated as optional .

Architecture Compiling RunPE as DLL Reading DLL Encrypting DLL Compressing encrypted DLL(optional) Adding encrypted Malware and DLL ass resources to stub Adding Icon to stub(optional) Compiling Stub as executable Adding Eof data to executable (optional) RunPE is compiled as a DLL because we want to encrypt and load it directly in memory . This can be made is because we have created it with managed code. And .Net framework can do the work for us.

Architecture Stub after execution: Read Encrypted DLL Decrypt DLL Load DLL in memory Read Encrypted malware Decrypt malware Call DLL for decrypted malware Malware inject to another process

Architecture Key Points Unique code Injection implemented in encrypted DLL Random Function Names, Class names, Variable names Encrypted Strings Result: Unique Executable

Crypters GUI and Options

Crypters GUI and Options

Crypters GUI and Options

Results The lab: Online Scanner http://nodistribute.com Windows XP 32/64 bit - Avast/AVG Windows Vista 32/64 bit – Kaspersky/Norton Windows 7 32/64 bit –Microsoft Security Essential/ESET Online Scanner http://nodistribute.com https://www.metascan-online.com Files Tested Netcat.exe Darkomet malware Poison Ivy

Results Virus Injection Method Windows Version RunPE Choice Working Detection Notes Darkcomet CSC 32bit 3 YES 0/40 64bit 2 5 6 Default Browser Mozilla Mozilla/Chrome Internet explorer svchost