6

I have been working with the veil framework to test an internal IDS system I have in place. I have used a public malware sample which produces an 8/53 hit score on Virustotal and run it through the Hyperion and Pescrambler veil payloads.

However, the output samples either retain the initial hit score or increase (in the case of Hyperion). Is this expected behavior from the veil framework? Is this due to the presence of dynamic analysis?

Are there any suggestions for generating packed and obfuscated executables with a higher degree of bypass efficacy for internal security testing?

  • 5
    The Veil team ask that you never submit Veil binaries to virustotal. The one time I've used Veil, it successfully got a Metasploit payload past Sophos - when all the Metasploit encoders were detected. – paj28 Jan 6 '15 at 12:42
  • veil-framework.com/… – atdre Nov 12 '15 at 0:56
3

The commenter, paj28, is correct: don't submit these to VirusTotal. Test them against the HIPS and AV systems you are specifically targeting in a VM-guest environment. I prefer using Vagrant along with the Packer and Boxcutter tools to "mock up" things in a lab.

Hyperion is great, but don't combine it with Pescrambler necessarily. You only need one cryptor, not two. What you ideally need is one cryptor and one packer, e.g., Hyperion and UPX. Try the various UPX formats and options: one will work after crypting. That would be the most-efficient and under-the-radar. Two cryptors or two packers is too many and "over the threshold".

Another factor is Meterpreter (or whatever baseline implant you are working from). It's not the best implant (some give away too much), especially not on Win32. It calls too many sensitive functions from too many W32 dependencies that are obviously malware. What you need is a different implant, such as Cobalt Strike Beacon or Silent Break Security Throwback. My favorite script circa Q42014 and Q1-2 2015 is veil_evasion.cna. It's in the official sources and probably PowerSploit, etc, but it can be loaded with a few others via this specific project from its original author -- https://github.com/HarmJ0y/cortana

  • It'd be good to include a reason for not submitting <foo> to <bar>, as you could either be spot on on some important technical or legal issue or you could be perpetrating some obscure and detrimental ritual/tradition, and OP (and myself :D) will not know how to distinguish. – Steve Dodier-Lazaro May 13 '15 at 2:26
  • @ Steve: Great question. So the basic answer is that you're fighting yourself: by submitting it, you're telling the AV companies that it's malware too simply since many factors will catch it. Check out the Malware Analyst's Cookbook or its tools here -- code.google.com/p/malwarecookbook -- there are many other resources but this is an ok starter – atdre May 13 '15 at 4:11
  • 1
    The gold advice is "test them against HIPS and AV system you are specifically targeting". The goal shouldn't be to bypass all AVs rather just the AV you are up against. – void_in May 13 '15 at 4:51
  • I suspect the thing you're implying is: no need to have the signatures of your low-effort "new" malware registered on every AV service, else you will have to spend more effort making more "new" malware for your next pentesting jobs. Is that the underlying reasoning? If so, making it more explicit in the answer body will help! – Steve Dodier-Lazaro May 13 '15 at 11:35
  • 2
    @SteveDL What atdre said is quite common in pentesting not to upload something to an online service. The reason is the moment you upload an executable to VirusTotal, if it is not detected by the AV, the antimalware analysts manually check the file and make signatures for it in the next AV update. Even discussing the technique used for AV bypass in a public forum usually make it blacklisted soon. That is why the idea is to setup a VM, install only the AV you are targeting, make sure the VM is disconnected from the Internet after update and then perform all the testing on this isolated VM. – void_in May 13 '15 at 18:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.