# Antivirus Evasion Methods in Modern Operating Systems
## 5 Research Environment and Toolset
### Antivirus Evasion Frameworks  
Hyperion [41] is a real-time encoder that was developed in 2012. The program was initially designed for the Windows operating system. To install it on Kali Linux, it is necessary to install the Wine package [42], which enables support for Windows operations in a Unix environment. Once the Wine package is installed, Hyperion can be downloaded, extracted, and converted into an executable file. Thereafter, the steps involved in using Hyperion are straightforward. The command below can be used:wine hyperion.exe payloadToEncrypt.exe encryptedPayload.exe  
In the terminal, the use of the Wine package to handle the Hyperion executable is indicated by providing two consecutive arguments. The first argument is the executable file to be encrypted, and the second argument is the output file of the already-encoded executable. The operation of Hyperion can be divided into two parts, namely the encryptor and the container. The encryptor takes the executable file to be encrypted, computes its checksum, and adds it to the file in memory. It then generates a random key that is used to encrypt the input file using the AES-128 algorithm, along with the previously calculated checksum. The container acts as a decryptor, copying and decrypting the encrypted input file and running it. As it lacks the decryption key, it performs a brute-force key space check based on a checksum to determine if the key is valid. Although this may seem like a disadvantage, it actually protects against static and dynamic analysis by antivirus engines. Author [PERSON] also mentions that the encrypted counterpart has an unknown signature and cannot be analyzed by heuristics, thereby protecting the binary code against reverse engineering or the replacement of encryption procedures with packers to reduce the size of the executable file [43]. However, since the document describing Hyperion is almost 10 years old, the claim about the unknown signature may no longer hold true. TheFatRat [44] is a potent exploitation tool developed by [PERSON], used for generating payloads that can run on various systems such as Linux, Windows, Mac, or Android [45]. It uses various evasion mechanisms such as obfuscation and cryptography techniques to hide the payload from antivirus scanners. This includes methods like encrypting the payload, encoding it in various formats, and using anti-debugging techniques. TheFatRat can modify the payload to bypass signature-based detection mechanisms used by antivirus software. This includes changing the file's signature or removing it altogether. Dynamic payload generation: The tool can generate payloads dynamically, meaning that each payload is unique and can not be detected by antivirus software that relies on pre-existing signatures. Polymorphic code: TheFatRat can generate polymorphic code, which means that the code changes each time it is executed, making it more difficult for antivirus software to detect. To install TheFatRat on a Kali Linux machine, the following commands are entered in the terminal:  
git clone [[https://github.com/Screetsec/TheFatRat.git](https://github.com/Screetsec/TheFatRat.git)]([https://github.com/Screetsec/TheFatRat.git](https://github.com/Screetsec/TheFatRat.git))  
cd TheFatRat  
chmod +x setup.sh &&./setup.sh  
After downloading TheFatRat repository and granting permission to execute the file, the installation process begins. Following this, the program update is carried out using the following commands in sequence:  
cd TheFatRat  
./update && chmod +x setup.sh &&./setup.sh  
To initiate TheFatRat tool, the user needs to execute a command in the terminal with administrator privileges. The options and tools can be accessed by entering the corresponding numbers assigned to the exploits. To exploit PwnWinds, which is a backdoor program offering the same payload as previously-mentioned tools, option 6 is selected. TheFatRat employs the Msfvenom tool to create payloads.