Antivirus Sandbox Evasion (part2) – Slides

1. sud0man permalink

   Fun and Good presentation !

   Reply
2. pentest0r permalink

   Great sharing !!! Thanks so much

   Reply
3. Teoz permalink

   Great presentation!
   I’ve tried an implementation based on your ideas but in my case Avira’s sandbox is always triggered because the signature is missing and the reputation it’s too low.
   My exe check if the tcp port 445 is reacheable, if not doesn’t executes the payload.
   After about 15s the sanbox terminates the program without threat warning but I’ve to manually add my exe to the exception list otherwise on the next run the situation is the same.

   Any suggestions? :-)
   TIA

   Reply
   • foip permalink

     you got a mail ;)

     Reply
4. GoodDog permalink

   Great Article! Pretty amazing :)

   Could you just explain to me the next code line in your home-made encoder :

   (*(void (*)()) (void*)lpAlloc)();

   This is to run the code stored in the allocated memory I presume but in details, I’m a little bit lost with all these Brackets… :)

   I’m not an expert in C and I’d like to understand.

   Thanks

   Reply

Leave a Reply