I want to make well-known malicious programs, like Mimikatz and Incognito, undetectable by anti-virus solutions.

I have already tried various approaches myself, like packing the binary with UPX or modifying the source code in C/C++ (+ various compiler optimizations). Suffice it to say, that my source code modifications are not simple, but using various forms of refactoring and removal of unnecessary features.

However, while all my attempts have reduced the number of detections on virustotal.com, still the majority of anti-virus solutions flags the resulting binaries as malware.

How can I modify or obfuscate the programs, either at the source code or binary level, to make them undetectable by majority of anti-virus solutions?

closed as too broad by NULLZ, Steffen Ullrich, Xander, Serge Ballesta, Tom K. Jul 3 '18 at 7:25

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.


How to make a well-known malicious programs undetectable by anti-virus solutions?

Just to be clear: In the body of the question you ask "How can I modify or obfuscate the programs... to make them undetectable..." This is not the question I am answering. I am providing an answer to the more general question posed in the title of the post. The reason for this is because it is difficult to answer the modify/obfuscate question without knowing exactly how the AV tools do their fingerprinting.

But anyways, one technique that I have found very helpful is to look at the configuration of the AV program. Often a unprivileged user can view the settings, even though they can not modify the configuration. In the settings there are often a number of "excluded" location. For example, a business may want to exclude certain "Program Files" subfolders from being scanned because it "trusts" the all executable in those folders.

If you find a "trusted" folder then just dump a 7zip/encrypted version of mimikatz (or whatever you want) into the trusted folder and unzip it in place there. Boom, you are in.

  • thanks for your post. Have you experience in using this technique from the command-line, i.e. does AVs normally provide command-line utilities to query excluded directories? – Shuzheng Jun 26 '18 at 20:01
  • No, I don't. Good luck. – hft Jun 26 '18 at 20:05
  • @Shuzheng Microsoft Security Essentials uses the registry to store exclusions, so you could read the keys. Other AVs might use the registry as well. I tried to write a .bat file to add to the exclusion list and I couldn't get it to work. I think the location in the registry required higher privileges. – mbomb007 Jun 26 '18 at 21:27

Other option that you have is to use metamorphism and polymorphic techniques. This will allow you to by pass some AV engines, depending on your code and on what you are doing but will be tedious for sure.

  • I know. But is there any tools available to transform the binary, or do you have to do it all yourself? – Shuzheng Jun 27 '18 at 5:12

Not the answer you're looking for? Browse other questions tagged or ask your own question.