3

For my college course, I am currently researching how malware works and stays undetected from antivirus and users. I built a proof of concept that stays hidden at scan time and run time.

If a hacker would spread this file, how would he keep it hidden? Avast, AVG, Microsoft, ... have sample submission on by default so I would guess that this file would last not more than a couple of weeks before being detected.

|improve this question
  • I guess the answer here us that not all files are submitted as samples. Only files, which are flagged as suspicious are. So as long as your malware does not activate its payload, it may not do anything warranting analysis. – Peter Harmann Oct 8 '18 at 13:03
  • One approach might be to limit the number of targets. If you want to keep the malware unnoticed, do not spread it out wildly. – Lukas Oct 8 '18 at 13:33
  • This is, kind of, the same as asking how malware is detected, which is a fair-sized question. Possibly too broad. – JᴀʏMᴇᴇ Oct 8 '18 at 14:16
1

You may refer the virus/malware type called 'Polymorphic Virus'.

A polymorphic virus is a complicated computer virus that affects data types and functions. It is a self-encrypted virus designed to avoid detection by a scanner. Upon infection, the polymorphic virus duplicates itself by creating usable, albeit slightly modified, copies of itself.

Source: https://www.techopedia.com/definition/4055/polymorphic-virus

Trend Micro explains it this way:

Polymorphic viruses are complex file infectors that can create modified versions of itself to avoid detection yet retain the same basic routines after every infection. To vary their physical file makeup during each infection, polymorphic viruses encrypt their codes and use different encryption keys every time.

Source: https://www.trendmicro.com/vinfo/us/security/definition/Polymorphic-virus

You can find some example of such codes here:

http://www.informit.com/articles/article.aspx?p=366890&seqNum=5

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.