I am using Hyperion v2.1 to scramble (polymorphism) some .exe file:

hyperion.exe myexefile.exe scrambled.exe

The resulting scrambled.exe file is detected and deleted by the AV or IDS system.

As far as I know, Hyperion performs some polymorphics changes, so generally it should work and be able to dodge AV defenses.

What can I do? Maybe increasing some parameters at Hyperion's config? Scrambling twice, or with another scrambler like PEScrambler?

  • 2
    hyperion looks pretty old, it may be that the AV has a method of detecting anything crypted with it, or that it just uses older methods that are easily picked up by heuristics - not many legitimate programs behave in a similar way to a naive crypter. In either case I doubt layered scrambling is likely to help much, if you can't write your own then I'd just try some different ones. It's worth pointing out that polymorphism isn't that useful against modern AVs that use more sophisticated techniques than hashes and static signatures. – Silver Oct 10 '19 at 18:24
  • @Silver, according to readme.txt the last version of Hyperion has date 10/07/2019 . I think date format means October. – Sopalajo de Arrierez Oct 10 '19 at 21:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.