4

I informed myself about RunPe Injection and programmed my own runPE. Right on my first try, I was able to hide a meterpreter payload from my antivirus program (Avira Antivirus).

The meterpreter payload is stored encrypted on the hard disk and then injected into the explorer.exe process and decrypted there.

The fact that the meterpreter payload cannot be recognized on the hard disk is due to the encryption, but in RAM the payload is not encrypted. Why can not the antivirus software detect the payload during a memory scan?

If you don't know what a runPE is click here.

2

AV's can, and do, detect in-memory malware with signatures as well as the act of process injection. Try running that same attack against other AVs and you'll get different results. Maybe upload it to Virus Total oy Hybrid Analysis and see what AVs detect it there?

As an aside Avira isn't a good AV, as you've proved, I'd recommend using something else.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.