Reply to thread

Message

<blockquote data-quote="Deleted member 65228" data-source="post: 710512">Make the binary appear closer to a genuine one from genuine, well-known software, as opposed to malware. Fatten up the Import Address Table (IAT), fatten up the strings, fatten up the PE details, add an icon and mess a bit more with the resource data, and that would probably be sufficient.Afterwards, change any of the Proof-Of-Concept &quot;malicious&quot; code to using dynamic imports and string obfuscation (hard-coded - no packing otherwise it&#039;ll ruin the above changes and make the entropy high). However, even with the string obfuscation for the real parts, the extensive dummy code with the non-obfuscated strings will even it out.The Ai score with VoodooAi should be so low that it&#039;ll be seen as &quot;safe&quot;/&quot;clean&quot;/&quot;trusted&quot; (whatever it&#039;s labelled in VoodooShield) and Auto-Pilot mode won&#039;t mind it, and thus won&#039;t display any alerts.You can literally go around with a fake chrome.exe binary, as long as it looks legit and the characteristics mislead it into believing it&#039;s closer to the real Google Chrome&#039;s chrome.exe, it&#039;ll not be warned about with the Auto-Pilot mode (no digital signature necessary). You may also need to pump the binary a bit.VoodooAi still flags a lot of malicious software though, it works because it takes into account characteristics like entropy level and thus a lot of packed program&#039;s will be in the firing line for being flagged. Since a lot of malware (especially ransomware) is packed.</blockquote>

[QUOTE="Deleted member 65228, post: 710512"] Make the binary appear closer to a genuine one from genuine, well-known software, as opposed to malware. Fatten up the Import Address Table (IAT), fatten up the strings, fatten up the PE details, add an icon and mess a bit more with the resource data, and that would probably be sufficient. Afterwards, change any of the Proof-Of-Concept "malicious" code to using dynamic imports and string obfuscation (hard-coded - no packing otherwise it'll ruin the above changes and make the entropy high). However, even with the string obfuscation for the real parts, the extensive dummy code with the non-obfuscated strings will even it out. The Ai score with VoodooAi should be so low that it'll be seen as "safe"/"clean"/"trusted" (whatever it's labelled in VoodooShield) and Auto-Pilot mode won't mind it, and thus won't display any alerts. You can literally go around with a fake chrome.exe binary, as long as it looks legit and the characteristics mislead it into believing it's closer to the real Google Chrome's chrome.exe, it'll not be warned about with the Auto-Pilot mode (no digital signature necessary). You may also need to pump the binary a bit. VoodooAi still flags a lot of malicious software though, it works because it takes into account characteristics like entropy level and thus a lot of packed program's will be in the firing line for being flagged. Since a lot of malware (especially ransomware) is packed. [/QUOTE]

Verification