AV Tracker

Ever set up a multi/handler and get an odd IP hitting it? Probably forgot about it as internet chatter? Think again, you might have just been caught

AV Tracker – ( http://avtracker.info/ ) is a site that tracks the different IP addresses, hostnames, computer names and user agents that AV and other “Submit-your-malware-here” drop boxes use.

Peter Kleissner and his team provide

• ranges that the hosts use
• a dynamic text file with the IP addresses listed if you want to add it to some auto updating block list
• a line by line IPTABLES block config
• and even C code to add into your binary to make sure it doesn’t talk out from one of those addresses (I could be reading it wrong, still a beginner in C)

The team has been criticized a lot by AV vendors, enough so the took down the site in January of this year. But it came back June 5th.

I use this site to help me know when the Incident Responders are on to me for my pen testing jobs. I do not wish to get in the debate of how a tool could be used.

AV bypass made stupid

*WARNING* if you use fgdump like I did, it extracts pwdump to %TEMP% at run time, which is detected by AV.

First of all, I was floored when this worked. Really AV? It’s that easy? Really?

So here is the break down, go get “Resource Hacker”… You’re almost done. Only 3 steps left. (1 of which is optional)

I started with fgdump, a well known hashdumping/pwdump tool. It’s detected by 80% of all AVs and by all the top 10. You see this on your AV report for your domain controller, and you’re having a bad day, probably week.

Watch this magic trick though:

[*] Step 1:

Open Res Hacker and drag a “normal” executable on to the window or Open File.

Click “Save All Resources”

Essentially what you are doing in this step is simply extracting the .ico file (Icon) from the executable. Now you can do this with other tools, but we’ll be using resource hacker in a minute again, so it’s just easy to do it all with one tool.

We are done with this executable unless you are doing Step 2, in that case, leave it open, open another Res Hacker window and open your ‘evil’. (In our case, fgdump.exe)

[*] Step 2 (Optional):

If you destination executable has tell-tale signs of it’s intent, much like fgdump as seen below:

You can simply copy and paste the version info from your ‘normal’ executable into your new one and hit “Compile Script”:

[*] Step 3:

Next we need to “Add a new Resource” (our icon) into our “evil” binary.

Once this prompt comes up, select the ICO file that shows the icon you want it to have (some binaries have a ton, so make sure it’s the right one). Put in ‘1’ for resource name, and ‘1033’ for your resource language. (You can play with these values, not sure what impact they have, but from the binaries I’ve looked at those values are pretty standard for a windows executable).

Save your new awesome binary as something else, I chose vlc2.exe

And… (drum roll)

Tada! Sad isn’t it? Only 1 of the top 10 AV now detect this binary. Good job AVG and Avast! You still picked it up, but Trend, Symantec, Microsoft, ClamAV, Kaspersky, Panda, Norman, NOD32, Sunbelt, F-Secure, Fortinet, BitDefender WTF guys!?

Oh and Kaspersky now flags it as “not-a-virus” but still flags it.