Hello and welcome to a new session, this new session is called Antivirus Evasion, and this lecture
is about an overview.
How did the Trojans that can evade antivirus
problems if antivirus for Melbourne Developers Virus Total or any online Scheinin who have a copy of
her sample and may eventually tag Smellie.
So do not have blood samples on virus, Twitter or any online platforms.
It provides Kenning.
They will have a copy of your sample and eventually target as malicious.
Dissolution Windows Defender Hollow could install antivirus.
The quarantine is simple, and this is also not a solution, because once your Windows defender or your
locally installed antivirus takes your, quote, trillionaire, smell their neighbor, quarantine it
and you will have a difficult time trying to develop on your system.
So what is the solution?
The solution is to use yaara.
Yara is to pattern making Swiss army knife for Melos searches.
They're yaara.
You can download from this link here and also download the Yarra rules, which are required by Yarah
from this link here in the next section.
We show you how to do that, how to download Stopera, and also how to download the rules and also how
to get started using Yaara.
So Yara is a kind of antivirus scanner that can scan malware based on better matching.
Georgian development lifecycle, where does Yaro come in?
First step is to develop a treaty, and then we will need to Skåne.
So in this case, he will use Yaro, the skinny Sierra was king based on this database.
This rules and you download and then if he takes it, you try to find out from the report, he will
tell you what was the pattern that mesh the Trojan.
And based on that report, you will make modifications.
You so you will modify your code in order to defeat the robots.
Then you can again see the result.
So you keep repeating this.
This is a directive.
Nope.
You keep repeating this cycle can do this, can destroy you.
Anything that is able to detect or tag your trigon as a malicious application.
So this is simply not within the realm of a cycle we should be adopting.
In that sense, antivirus evasion techniques, also known as anti Eevee much.
Three common ways we can use in order to keep virus from in hiding is away.
We try to hide the function calls.
We try to hide the API name we are using in the Trojan.
So because antivirus scanners also look at the inputs.
What kind of functions or APIs.
That particular application is using.
Second is encrypting encryption of string parameters, string parameters, parameters, function calls.
Some parameters can also be tagged as Americans based on the occurrence of them.
How many of them are occurring together?
Oh, and Commissioner Bill Peter, beaten by Scoobie Shakuri.
So the Shakuri cell could be a recognizable pattern, which is in a database.
We know the rules for the antivirus that the encoding of string parameters.
Peter Pace.
So these are two, three common ways in which we can use it to evade device.
Thank you for watching.
I'll see you in person.