Hello and welcome to a new lesson in this lesson, I'm going to show you how to evade antivirus are
going down this project 13 dash Avie death evasion from the recession.
Unzip it and put it in the now Defour.
You open the folder and you see the nitrogen that we created from the previous lesson.
Then we did the let project.
So this Trojan here will inject into the exploratory process and then he will cost he shockoe to open
the messagebox.
Now we are going to scan this quiara so open a command line terminal xixi for is going on, and then
this change to this store directory, copy spark and then KDI right click into.
So we're going to do a virus.
Can Tierra 64 heading for the path to the virus?
And then now only type in the name of the Trojan horse, he said EXR and then give the W and this options.
Now, I already set my properties for the LEHA.
To be with 140 so that I can have a better view.
No, he didn't.
And it's skin.
And here's the result.
Notice that it has detected.
A.D. Bungay, it was also detected in Gentry, and these are the the conditions that see inject Trent
rule.
These are recognition's conditions.
And there are also other things that they're lying in foul.
But this one is the most damaging one, because from this condition, condition, one condition, the
condition for condition fifing condition seven herea has concluded that this is a malicious program
because it is capable of injecting.
So if you want to know more details about this room, just open notepad.
And you will look at the details of this house simply on search finance files.
And then here, make sure, you know, we get to the Yara rules.
Fouda, we are going to search.
Here are rules for the for the rules that define these injector.
So you like these rules, Holder?
Michaud is correct.
And then here we are going to search for injector.
So just to inject underscore, Trey, the one that you see here, the rule and including final.
So you got one hit, Jack Trent is fun in this Fiala.
And the capabilities for the.
And you say that you have a capability's yaffa and then to see the content of these capabilities, Yaffa,
you double click and you resolve a huge issue in the chat room is define the metadata, the version,
the strings and the condition.
Those are the mean parts for Huru in Yaro.
The important one is your strength and conviction.
So here you have a string, once he wants you to see trees, you fall.
So these are his trees and these are the conditions that he will.
He defines whether or not this intact trek capability exists.
So if you find it, see one and see two houses and see three or four.
And see if I see 647, if this condition is satisfied, then Iran will conclude that this melee, that
this program that you are skinny is capable of injecting.
So this is how you works.
So you can see from here, if you want to defeat this this rule, all we have to do is study the conditions.
So the condition for inject track will be true.
You see one can see two and this and this are true.
So in order to defeat it, we only need to defeat SE1 if he offers it this open process function call,
and then he will feel to take this into treck capability.
Alternatively, we can also choose to obfuscate, which you are lucky.
If you do that second condition, we will the false.
And so the whole condition also feel.
So this is how you can use these files where the rules are defined in order to study and understand
how you can defeat antivirus.
In this case here, I'm going to show you how to obfuscate this tree, which.
Hello?
Yes.
That process, memory and human trait.
So let's try it now.
I've already created this file for you.
That has got a new court for avoiding antivirus.
So we are using the estrogen development lifecycle.
You have developed it?
Yes.
Can you see a result?
Have you studied the report?
And now we know what to do.
You have to do a modification to our file so that this thing will not be detected in the skin.
So in order to do that, we will use hunkin obfuscation.
Also known as function hiding and also encryption or string parameters.
So let's get started.
So this fall, you already have this I share this with you in the first lecture for this session.
So let's open the so-called file and you will see the modification that I made.
Coming back to the court.
Let me explain this to function pointers up here.
So this refreshing pointis BGR with her long PDR persist memory and peaty are creating more out then
by going to mischin.
So you go to my machine for which eler and you copy.
Copy this definition for which you allow.
And put it here.
And then you convert it into a function pointer by putting the API in asterisk frame and put the opening
and closing bracket back and also changing in to PITR.
And then same thing for right.
Process memory you're getting from here.
And finally, for creative military use in getting from here.
So this is how we create this function pointers which are used, say your chacal check who are here
and then they change.
Could I have I created this additional lines?
I have cone with it.
This function calls the create wrote you add up, we can call into a pointer.
Same thing with the right reprocessed memory.
I've converted into a point function pointer.
Same here as for creating Moutray.
So because these are fashion pointers, you have to resolve it before you can use to point.
So this tree, this tree line we use get progress is very eyestrain, which are lot from going into
D2 and return the address to it.
Same thing with positioning the right process memory and also creating a tree in this tree.
The string switch has been an encrypted because we don't want any antivirus to scan these things.
So we are encrypted and put it here.
So a string, which I know this is easily encrypted and it is encrypted using the this secret key.
And then for possess memory is encrypted using the secret key as well.
And the same thing, the Clairemont Train.
So that's how we encrypt.
And here is very decrypt these three strings.
So after the coopting, you will get back the plane tax for which you long and the plane tax to overeaten
into this history.
And here is where you used to have been sitting in this line.
You would write precess memory and I and use it here, say Methy creating Moutray.
So how do we get this encryption?
They say maybe we didn't the last time.
Maybe they were doing functioning obfuscation.
You used the Python script.
So in order to use the screen, the fathers so we could have file for Python script to read.
So we create a new file here and you can call it to be encrypted.
And you say here we put the first thing that you want to encrypt, which is which aola.
He.
And ABC, which.
Hello.
He is now yakking and creepy.
We come here.
It's clear the screen, the code of Python two point seven.
And then we give it the script and click.
Yes, a lot.
And then you input file is to be encrypted, to be encrypted, and then the output file.
So we need to futureproof out here because this screen that's open and see this discrete will encrypt
and save and ciphertext.
And then you have all these different things you did for me or X in front so that you can be using the
our code here in this format.
So we put the file, you can see and Krypto Aizawa see president.
And now you see there's a new file.
And because I saw so we opened this and you copy.
Copy this, I get a copy.
And you come to your son's school and P.S. here.
So is how I got his name, PC.
OK.
And do the same thing for the other to write process memory and also create remotely the exact same
thing.
So to do that, you just have to come back here and change the to be encrypted.
Chief, this is string.
Here to second function, if you want to increase, is your right process memory.
So this typewrite process memory.
See, and they know over here.
Repeat command.
And they'll come back here.
Reopen is fire.
And in.
Yes, we look so copy.
I notice there's another monitor here is your tracks here by Vaisakhi because here for the replay string
length, the size of function.
So it will not cause any errors.
So it is copy and paste here.
Right now in the Navy, we're doing a lesson on encryption.
I tell you, if you have another minute of insight because we're here, you are using Strimling to calculate
the length of the string.
But now we replace it with Siza.
So Siza is immune to not a meter.
So it's OK to have not a meter.
OK, so not a last one is clearly Moutray chief, these two creating more track.
We will try and save it and repeat this one and then come here a copy or encrypt that stream, creating
military copy and put it into your.
Cohere.
OK.
All right, so this is how this program will work.
When you call this function, you will run the women here, women to consult, to make it stealthy.
And then he will come down here.
And then he will find a resource to create the Chalco for the message, which we already stated before,
and then create the new allocation and move to memory and so on.
And he could use her good and then come down here hoping that possess the export process.
And here she is going to inject so many injections.
He comes up here and over here you look the string for which are along, which is encrypted string for
which for reemphasis, memory, which is encrypted history for Climo trick, which is also encrypted.
And here you decrypt all the trees and civvy.
Yes.
Has tanks.
And down here, he uses and get forwardness to retrieve the address of the various APIs from country
to and in in this point in their booth.
And then now here he makes use of them, for which I look is this one.
And for access memories here and over here, he's trying to create emotion.
So this Hywel.
So let's let's give it a run.
Me?
Sure.
How?
Let's compare it first.
And be sure he works, right?
Yes.
And so now you can double click it to see if he works.
So we just have achiness.
And he looks at to confirm that this is coming from Explorer has opened this open process hacker and
then drag this over this release.
And you can see that either pattern for this message, MessageBox is Explorer.
And you can go to the memory here and scroll down and look at to our accession.
This one without any mocking old openI.
Not this one.
The other one is here.
It's tiny marking IREX.
And here you can see I wish I could decrypt it.
And now is working.
So let's test it.
So we repeat under are asking again.
This time you see whether you can detect it.
OK, let's scrub and see.
And you see, he has failed to detect the check.
So it looks like the Vipassana and device.
So this is how you can bypass antivirus.
Using this Trojan development lifecycle who are here.
So this is how it works.
That's all for this session.
Thank you for watching.