AV Bypass Made Stupid

Tuesday, July 13, 2010

Rob Fuller

D8853ae281be8cfdfa18ab73608e8c3f

*WARNING* if you use fgdump like I did, it extracts pwdump to %TEMP% at run time, which is detected by AV.

First of all, I was floored when this worked. Really AV? It’s that easy? Really?

So here is the break down, go get “Resource Hacker”… You’re almost done. Only 3 steps left. (1 of which is optional)

I started with fgdump, a well known hashdumping/pwdump tool. It’s detected by 80% of all AVs and by all the top 10. You see this on your AV report for your domain controller, and you’re having a bad day, probably week.

fgdump_virustotal

Watch this magic trick though:

[*] Step 1:

Open Res Hacker and drag a “normal” executable on to the window or Open File.

Click “Save All Resources”

res_hack_vlc

Essentially what you are doing in this step is simply extracting the .ico file (Icon) from the executable. Now you can do this with other tools, but we’ll be using resource hacker in a minute again, so it’s just easy to do it all with one tool.

We are done with this executable unless you are doing Step 2, in that case, leave it open, open another Res Hacker window and open your ‘evil’. (In our case, fgdump.exe)

[*] Step 2 (Optional):

If you destination executable has tell-tale signs of it’s intent, much like fgdump as seen below:

res_hack_version_info

You can simply copy and paste the version info from your ‘normal’ executable into your new one and hit “Compile Script”:

res_hack_version_info2

[*] Step 3:

Next we need to “Add a new Resource” (our icon) into our “evil” binary.

res_hack_add_resource

Once this prompt comes up, select the ICO file that shows the icon you want it to have (some binaries have a ton, so make sure it’s the right one). Put in ‘1’ for resource name, and ‘1033’ for your resource language. (You can play with these values, not sure what impact they have, but from the binaries I’ve looked at those values are pretty standard for a windows executable).

res_hack_add_icon

Save your new awesome binary as something else, I chose vlc2.exe

res_hack_save

And… (drum roll)

 

vlc2_virustotal

Tada! Sad isn’t it? Only 1 of the top 10 AV now detect this binary. Good job AVG and Avast! You still picked it up, but Trend, Symantec, Microsoft, ClamAV, Kaspersky, Panda, Norman, NOD32, Sunbelt, F-Secure, Fortinet, BitDefender WTF guys!?

Oh and Kaspersky now flags it as “not-a-virus” but still flags it.

Cross-posted from Room362

Possibly Related Articles:
14802
Vulnerabilities
Hacks Web Application Security
Post Rating I Like this!
Default-avatar
Koen Bossaert Cool. I usually just run a packer on executables to circumvent AV. Any packer like the well-known UPX will do.
upx fgdump.exe and you're done. Just submit to virustotal to verify.
1279122822
The views expressed in this post are the opinions of the Infosec Island member that posted this content. Infosec Island is not responsible for the content or messaging of this post.

Unauthorized reproduction of this article (in part or in whole) is prohibited without the express written permission of Infosec Island and the Infosec Island member that posted this content--this includes using our RSS feed for any purpose other than personal use.