How to Make Virus/Trojan Undetectable
It’s very simple to make a virus, but to make it undetectable by the antiviruses is the hard part. Some time ago i found a great tutorial how to make trojans undetected on Hackforums.net, and here i want to share it. In this post i’m going to show you how does anti-virus software work and how to make a virus that won’t be detected by any anti-virus software.
Most anti-virus scanners rely on a database of signatures for known viruses. Once a new virus is spread wide enough that it has been identified as malicious, the anti-virus vendors scramble to come up with a fingerprint to identify that strain of malware in the future. The obvious flaw in this process is that a new piece of malware will bypass the scanners by default, until it is widespread enough to be noticed by security researchers or picked up by a dummy node.
Here i will be showing you 4 ways of how to make a Trojan undetectable to Anti-Virus software. I am sure there are more then 4, but these should help get you started.
1. Encryptors/Compressors:
You would think this should be the easiest way to UD (Undetect) a Trojan…but alas, it is not. The problem is simply this, most people use the same Trojans and Packers so often that Anti-Virus software knows pretty much all the signatures. They either use Ardamax Keylogger, Optix Pro, Beast, ProRat etc. for Trojans. For Packers they use UPX, PECompress, AsPack, Mophine etc. Again, none of these combinations work because all the signatures have been flagged. The best way this option will work is to find lesser known Packers and Trojans to work with.
Try a Google search for Executable Packers. Get a few that you have not heard of before or that have a decent rating. If it is not freeware, I am sure there will be a Crack for it. For Trojans, three good resources are VXChaos, LeetUpload or VX Heaven. Remember to pick the ones that are not well known and try to mix and match those Trojans and Packers.
2. Byte Adders:
This technique allows you to add junk bytes to your Trojan as to confuse Anti-Virus software. It does this by moving the code around inside the executable as the bytes are being added. This means that the signature will not be in the place the Anti-Virus expects it to be. A good tool for this would be StealthTools v2.0 by Gobo.
Click links below for full articles
Hex Editing
Related posts: