AV Bypass Made Stupid

Tuesday, July 13, 2010

Rob Fuller


*WARNING* if you use fgdump like I did, it extracts pwdump to %TEMP% at run time, which is detected by AV.

First of all, I was floored when this worked. Really AV? It’s that easy? Really?

So here is the break down, go get “Resource Hacker”… You’re almost done. Only 3 steps left. (1 of which is optional)

I started with fgdump, a well known hashdumping/pwdump tool. It’s detected by 80% of all AVs and by all the top 10. You see this on your AV report for your domain controller, and you’re having a bad day, probably week.


Watch this magic trick though:

[*] Step 1:

Open Res Hacker and drag a “normal” executable on to the window or Open File.

Click “Save All Resources”


Essentially what you are doing in this step is simply extracting the .ico file (Icon) from the executable. Now you can do this with other tools, but we’ll be using resource hacker in a minute again, so it’s just easy to do it all with one tool.

We are done with this executable unless you are doing Step 2, in that case, leave it open, open another Res Hacker window and open your ‘evil’. (In our case, fgdump.exe)

[*] Step 2 (Optional):

If you destination executable has tell-tale signs of it’s intent, much like fgdump as seen below:


You can simply copy and paste the version info from your ‘normal’ executable into your new one and hit “Compile Script”:


[*] Step 3:

Next we need to “Add a new Resource” (our icon) into our “evil” binary.


Once this prompt comes up, select the ICO file that shows the icon you want it to have (some binaries have a ton, so make sure it’s the right one). Put in ‘1’ for resource name, and ‘1033’ for your resource language. (You can play with these values, not sure what impact they have, but from the binaries I’ve looked at those values are pretty standard for a windows executable).


Save your new awesome binary as something else, I chose vlc2.exe


And… (drum roll)



Tada! Sad isn’t it? Only 1 of the top 10 AV now detect this binary. Good job AVG and Avast! You still picked it up, but Trend, Symantec, Microsoft, ClamAV, Kaspersky, Panda, Norman, NOD32, Sunbelt, F-Secure, Fortinet, BitDefender WTF guys!?

Oh and Kaspersky now flags it as “not-a-virus” but still flags it.

Cross-posted from Room362

Possibly Related Articles:
Hacks Web Application Security
Post Rating I Like this!
Koen Bossaert Cool. I usually just run a packer on executables to circumvent AV. Any packer like the well-known UPX will do.
upx fgdump.exe and you're done. Just submit to virustotal to verify.
The views expressed in this post are the opinions of the Infosec Island member that posted this content. Infosec Island is not responsible for the content or messaging of this post.

Unauthorized reproduction of this article (in part or in whole) is prohibited without the express written permission of Infosec Island and the Infosec Island member that posted this content--this includes using our RSS feed for any purpose other than personal use.