使用源泉代码为执行外代码的技术来逃避抗病毒检测
Gang-Cheng Huang1, Ko-Chin Chang2, Tai-Hung Lai1
1Department of Computer Science and Information Engineering, Chung Cheng Institute of Technology, National Defense University, Taoyuan 335009, Taiwan.
Sensors (Basel, Switzerland)
|January 25, 2025
概括
本研究介绍了源代码,以逃避恶意shellcode.code的防病毒检测. 对32位和64位shellcode的编码显著降低了检测速率,增强了逃避能力.
科学领域:
- 网络安全 网络安全
- 计算机科学 计算机科学
- 网络安全 网络安全
背景情况:
- 抗病毒软件努力检测复杂的,模糊的恶意代码.
- 在透测试和安全研究中,避开外代码至关重要.
研究的目的:
- 开发和评估一种新的方法,以使用喷泉代码来逃避防病毒检测.
- 为了评估这种方法对Windows架构的Meterpreter shellcode的有效性.
主要方法:
- 用32位和64位Windows的Meterpreter框架生成了恶意外代码.
- 喷泉代码被用来编码外代码,将其分解成具有独特结构的包.
- 模糊的shellcode被对抗病毒供应商进行了测试,以测量检测率.
主要成果:
- 32位贝代码的检测率从18个减少到3个实例.
- 64位贝代码的检测率从16个下降到1个实例.
- 喷泉代码编码保持了shellcode的完整性,并确保了正确的执行.
结论:
- 喷泉代码编码是一种有效的技术,可以逃避恶意shellcode.code的防病毒检测.
- 该方法为透测试中的持久性阶段提供了有价值的工具.
- 对先进的遮技术的进一步研究是有必要的.
相关概念视频
Leaky Scanning
During most eukaryotic translation processes, the small 40S ribosome subunit scans an mRNA from its 5' end until it encounters the first start AUG codon. The large 60S ribosomal subunit then joins the smaller one to initiate protein synthesis. The location of the translation initiation is largely determined by the nucleotides near the start codon as there may be multiple translation initiation sites present on the mRNA. Marilyn Kozak discovered that the sequence RCCAUGG (where R stands for...
Prevention of Further Absorption of Poison
In cases of acute poisoning, the primary objective is to prevent further absorption of the toxic substance into the body. Immediate interventions using various decontamination techniques targeting the gastrointestinal (GI) tract can achieve this. Decontamination is crucial to prevent poison from entering the systemic circulation, which involves washing affected areas with water and mild soap and removing contaminated clothing. Once external decontamination is done, attention must be turned to...
Clamper Circuit
A clamper circuit, also known as a DC restorer, represents a specialized variant of the rectifier circuit, notable for its method of taking the output across the diode rather than the capacitor. This configuration lends to several distinctive applications, particularly in handling square wave inputs.
Within this circuit, the diode's orientation prompts the capacitor to charge up to the level of the most negative peak of the input signal. Upon reaching this state, the diode ceases to conduct,...
Within this circuit, the diode's orientation prompts the capacitor to charge up to the level of the most negative peak of the input signal. Upon reaching this state, the diode ceases to conduct,...
Underflow Gates
Underflow gates are vital for controlling water flow in irrigation canals. The three main types of underflow gates — vertical, radial, and drum gates — serve different purposes while ensuring effective flow management. Vertical gates move up and down, generating a free-flowing water jet; radial gates pivot to regulate the flow; and drum gates rotate for precise adjustments. The flow through these gates is influenced by downstream conditions, resulting in free or drowned outflow.Free and Drowned...
Introduction to Virus
Viruses are unique biological entities that blur the boundary between living and non-living systems. Although they lack cellular structure and metabolic processes, they can exhibit characteristics of life when infecting a host. Their defining feature is a nucleic acid core, composed of either DNA or RNA, encapsulated within a protein coat called a capsid. This simple structure allows them to invade host cells and use their machinery for replication efficiently.Viral Structure and...
Viruses of Archaea
Archaeal viruses play a crucial role in the ecosystems of extremophilic archaea, particularly those belonging to the phyla Euryarchaeota and Crenarchaeota. By shaping host evolution and facilitating gene transfer, these viruses influence microbial communities and contribute to genetic diversity in extreme environments. The archaea they infect thrive in acidic hot springs and hydrothermal vents characterized by high temperatures and low pH. Archaeal viruses exhibit remarkable structural...


