AVET ↑ Antivirus Evasion Tool ↓

[PayloadPilot]

AVET is an antivirus evasion tool, which was developed to make life easier for pentesters and to experiment with antivirus evasion techniques, as well as other methods used by malicious software.

To see this hidden content, you need to "Reply & React" with one of the following reactions: Like, Love, Haha, Wow

Features

• When an .exe file created with msfpayload & co is executed, antivirus software usually recognizes the file.
• AVET is an antivirus evasion tool targeting Windows machines with executable files.
• Different types of input payloads can now be used: shellcode, exe and dlls.
• More techniques available: shellcode/dll injection, process flushing and more.
• flexible recovery methods for payload, decryption key, etc.
• dropper usage
• Chaining multiple iterations of AVET allows you to add multiple layers of evasion, if needed.
• combination of techniques: download your encrypted payload via PowerShell, while providing the decryption key via command line argument at runtime, and finally inject your payload into another process, choosing from multiple techniques.
• basic test zone checks
• generation of adversarial examples against static machine learning-based detectors
• running all available build scripts with build_script_tester.py, it could also be interesting for researchers to create a set of "malicious" samples using different evasion and injection techniques.

IMPORTANT NOTE
"Not all techniques will bypass all AV engines. If one technique or compilation script doesn't work, try another - feel free to experiment! After all, this is a toolbox, but you must wield the hammer yourself".

 

[OLIVER123]

thanks

 

[esreverpD]

Okayyyy