Antivirus Evasion Methods in Modern Operating Systems
Source abstract
Abstract
In order to safeguard one’s privacy while accessing the internet, it is crucial to have an antivirus program installed on the device. Despite their usefulness in protecting against malware, these programs are not foolproof. Cybercriminals have access to numerous techniques and tools for circumventing antivirus software, which can greatly aid them in their illicit activities. The objective of this research was to examine the most prevalent methods and tools for bypassing antivirus software and to demonstrate how readily accessible and simple they are to use. The aim of this paper is to raise awareness among readers about the associated risks and to assist internet users in protecting themselves from potential threats. The findings of the research indicate that the efficacy of evasion tools is positively correlated with their age and popularity. Tests have shown that, with the latest updates, contemporary antivirus software is capable of resisting virtually all of the tested methods generated using default settings. However, the most significant aspect of this paper is the section presenting experiments with basic but powerful modifications to established evasion mechanisms, which have been found to deceive modern, up-to-date antivirus software.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Advanced Malware Detection Techniques · Network Security and Intrusion Detection · Spam and Phishing Detection
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Institute of Informatics, Silesian University of Technology, 44-100 Gliwice, Poland
References (51)
Show source-provided references
1. (2023, April 15). AV-Test Malware. Available online: https://www.av-test.org/en/statistics/malware/.
2. Sharif, M.I., Lanzi, A., Giffin, J.T., and Lee, W. (February, January 10). Impeding Malware Analysis Using Conditional Code Obfuscation. Proceedings of the 4th Virus Bulletin International Conference, San Diego, CA, USA.
3. Kalogranis, C. (2018). AntiVirus Software Evasion: An Evaluation of the AV Evasion Tools. [Ph.D. Thesis, University of Piraeus Department of Digital Systems].
4. Evaluating the effectiveness of antivirus evasion tools against windows platform
5. Panagopoulos, I. (2020). Antivirus Evasion Methods. [Ph.D. Thesis, University of Piraeus Department of Digital Systems].
6. Garba, F.A., Yarima, F.U., Kunya, K.I., Abdullahi, F.U., Bello, A.A., Abba, A., and Musa, A.L. (October, January 18). Evaluating Antivirus Evasion Tools Against Bitdefender Antivirus. Proceedings of the International Conference on FINTECH Opportunities and Challenges, Karachi, Pakistan.
7. A taxonomy of obfuscating transformations
8. A survey on android malware obfuscation
9. F-Secure (2023, April 15). State of Cyber Security 2018. Available online: https://www.f-secure.com/documents/996508/1030743/F-Secure_State_of_Cyber_Security_2018.pdf.
10. Mandiant (2023, April 15). M-Trends 2018: A View from the Front Lines. Available online: https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-2018-mtrends.pdf.
11. Christodorescu, M., Jha, S., and Seshia, S.A. (March, January 27). Static analysis of executables to detect malicious patterns. Proceedings of the 12th Annual Network and Distributed System Security Symposium (NDSS’05), San Diego, CA, USA.
12. Moser, A., Kruegel, C., and Kirda, E. (2007, January 10–14). Limits of static analysis for malware detection. Proceedings of the 23rd Annual Computer Security Applications Conference (ACSAC’07), Miami Beach, FL, USA.10.1109/ACSAC.2007.21 ↗
13. Ligh, M., Adair, S., Hartstein, B., and Richard, M. (2014). Malware Analyst’s Cookbook and DVD: Tools and Techniques for Fighting Malicious Code, John Wiley & Sons.
14. Combating virtual machine detection and fingerprinting
15. Kephart, J.O. (, 1994). Automatic Extraction of Computer Virus Signatures. Proceedings of the 4th Virus Bulletin International Conference, Abingdon, UK.10.1016/0142-0496(94)90045-0 ↗
16. Virus signature detection algorithm
17. Computer Viruses: Theory and Experiments10.1016/0167-4048(87)90122-2 ↗
18. Bazrafshan, Z., Hashemi, H., Fard, S.M.H., and Hamzeh, A. (2013, January 28–30). A Survey on Heuristic Malware Detection Techniques. Proceedings of the Conference on information and Knowledge Technology, Shiraz, Iran.10.1109/IKT.2013.6620049 ↗
19. Cohen, F. (1986). Computer Viruses. [Ph.D. Thesis, University of South California].
20. Gryaznov, D. (, January September). Scanners of The Year 2000: Heuristics. Proceedings of the Fifth International Virus Bulletin Conference, Boston, MA, USA.
21. Kaspersky (2023, April 15). usa.kaspersky.com. Available online: https://usa.kaspersky.com/resource-center/definitions/heuristic-analysis.
22. Wressnegger, C., Freeman, K., Yamaguchi, F., and Rieck, K. (2016). From Malware Signatures to Anti-Virus Assisted Attacks. arXiv.10.1145/3052973.3053002 ↗
23. Wressnegger, C., Freeman, K., Yamaguchi, F., and Rieck, K. (2017, January 2–6). Automatically inferring malware signatures for anti-virus assisted attacks. Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security, Abu Dhabi, United Arab Emirates.10.1145/3052973.3053002 ↗
24. Code Obfuscation Literature Survey
25. Kaushik, K., Sandhu, H.S., Gupta, N.K., Sharma, N., and Tanwar, R. (2021). Emergent Converging Technologies and Biomedical Systems: Select Proceedings of ETBS 2021, Springer.
26. Transforming malicious code to ROP gadgets for antivirus evasion10.1049/iet-ifs.2018.5386 ↗
27. Camouflage in Malware: From Encryption to Metamorphism
28. PEzoNG: Advanced Packer For Automated Evasion On Windows10.1007/s11416-022-00417-2 ↗
29. Scaife, N., Carter, H., Traynor, P., and Butler, K.R. (2016, January 27–30). Cryptolock (and drop it): Stopping ransomware attacks on user data. Proceedings of the 2016 IEEE 36th International Conference on Distributed Computing Systems (ICDCS), Nara, Japan.10.1109/ICDCS.2016.46 ↗
30. Generating antivirus evasive executables using code mutation
31. Redcanary.com (2023, April 15). Process Injection. Available online: https://redcanary.com/threatdetection-report/techniques/process-injection/.
32. Ashkan Hosseini (2023, April 15). Ten Process Injection Techniques. Available online: https://www.elastic.co/blog/ten-process-injection-techniques-technical-surveycommon-and-trending-process.
33. Sanjay, B.N., Rakshith, D.C., Akash, R.B., and Hegde, V.V. (2018, January 20–22). An approach to detect fileless malware and defend its evasive mechanisms. Proceedings of the 2018 3rd International Conference on Computational Systems and Information Technology for Sustainable Solutions (CSITSS), Bengaluru, India.10.1109/CSITSS.2018.8768769 ↗
34. D’Elia, D.C., Invidia, L., and Querzoni, L. (2021, January 4–8). Rope: Covert multi-process malware execution with return-oriented programming. Proceedings of the Computer Security–ESORICS 2021: 26th European Symposium on Research in Computer Security, Darmstadt, Germany. Proceedings, Part I 26.10.1007/978-3-030-88418-5_10 ↗
35. Kali Linux Team (2023, April 15). Kali Docs. Available online: https://www.kali.org/docs/.
36. G0tmi1k (2023, April 15). What is Kali Linux. Available online: https://www.kali.org/docs/introduction/what-is-kali-linux/.
37. Rapid7 (2023, April 15). Metasploit. Available online: https://metasploit.com/.
38. Rapid7 (2023, April 15). Msfvenom. Available online: https://github.com/rapid7/metasploit-framework/blob/master/msfvenom.
39. Rapid7 (2023, April 15). Shikata Ga Nai Repo. Available online: https://github.com/rapid7/metasploitframework/blob/master/modules/encoders/x86/shikata_ga_nai.rb.
40. Miller, S., Reese, E., and Carr, N. (2023, April 15). Shikata Ga Nai Encoder Still Going Strong. Available online: https://www.mandiant.com/resources/shikata-ga-nai-encoderstill-going-strong.
41. Belial (2023, April 15). Hyperion. Available online: https://nullsecurity.net/tools/binary.html.
42. Wine Team (2023, April 15). WineHQ. Available online: https://www.winehq.org/.
43. Christian Ammann (2023, April 15). Hyperion: Implementation of a PE-Crypter. Available online: https://www.exploit-db.com/docs/english/18849-hyperion-implementation-ofa-pe-crypter.pdf.
44. Edo Maland (2023, April 15). TheFatRat. Available online: https://github.com/screetsec/TheFatRat.
45. BlackHat (2023, April 15). TheFatRat. Available online: https://www.blackhatethicalhacking.com/tools/thefatrat/.
46. kyREcon (2023, April 15). Shellter. Available online: https://www.shellterproject.com/introducing-shellter/.
47. kyREcon (2023, April 15). Shellter Readme. Available online: https://www.shellterproject.com/Downloads/Shellter/Readme.txt.
48. VeilEvasion Team (2023, April 15). Veil. Available online: https://github.com/Veil-Framework/Veil.
49. Srinivas (2023, April 15). Antivirus Evasion Tools. Available online: https://resources.infosecinstitute.com/topic/antivirus-evasion-tools/.
50. AV-Comparatives (2023, April 15). Summary Report 2021. Available online: https://www.av-comparatives.org/tests/summary-report-2021/.
51. Statista Research Department (2023, April 15). Which Version of Antivirus Program Do You Use on Personal Devices?. Available online: https://www.statista.com/statistics/1252587/free-vs-paid-antivirus-usage-by-brand-russia/.