# Antivirus Evasion Methods in Modern Operating Systems
## 6 Experimental Procedures and Results for Antivirus Bypass Mechanisms
As a result, processes launched by infected files may not have attracted much attention, and, consequently, antivirus developers may have been less attentive to this port in the past. However, half of the tested antiviruses did not detect the static load on port 4444 at the level of static scans. Due to the longevity of research and the successful evasion of antiviruses, the authors decided to redo all tests after eight months, with updated version of antiviruses and their databases. The installed antivirus updates rendered all six tested antiviruses immune to the old threat. This indicates that antivirus updates are necessary and effective, as evidenced by the results of the online scan. From the results, it can be inferred that the antiviruses tested eight months ago were less effective than the newer ones, except for the generated.bat file that returned worse results in the second study, possibly due to a scan error or a problem with the software engine vendor. In conclusion, the only effective tool appears to be the payload generated in TheFatRat, based on the C language and PowerShell, but only when confronted with the AV6 antivirus. In another study, we utilized Shellter software to inject a generated payload into a potentially safe program. The process began with downloading an appropriate program that would serve as the host for the payload injection. From a security point of view, the process should be not malicious. Standard processes without changes should not be flagged by antiviruses. The reason for utilizing Shellter was to change not-malicious process into malicious ones, hopefully also bypassing antiviruses. ColorPix was identified as a suitable program for this purpose, given its functionality as a color retrieval tool that does not \begin{table}
\begin{tabular}{l c c c c c c c c c} \hline \hline \multirow{3}{*}{**Payload**} & \multirow{3}{*}{**Online Scan**} & \multicolumn{6}{c}{**AV Results**} \\ \cline{3-10}  & & **AV1** & **AV2** & **AV3** & **AV4** & **AV5** & **AV6** \\ \cline{3-10}  & & **S** & **A** & **S** & **A** & **S** & **A** & **S** & **A** \\ \hline
**Hyperion** & 19/26 & Y & Y & Y & Y & Y & Y & Y \\ \hline
**+SNG** & 19/26 & Y & Y & Y & Y & Y & Y & Y \\ \hline
**+Hex** & 19/26 & Y & Y & Y & Y & Y & Y & Y \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Hyperion results. require installation. However, we should note that any file will render, in most modern cases, the same results, as the process is not tested but the structure is, which has changed from the antivirus point of view. In other words, the payload should be detected, not the transportation mechanism--in this case, usage of ColorPix. Using Shellter, the basic payload was successfully injected into the downloaded program. To evaluate the effectiveness of the injected payload, we subjected it to static scans by six different antivirus software programs. Surprisingly, as shown in Table 3, the injected payload was able to evade detection by five of the six tested antivirus software programs, with only AV5 exhibiting immunity to the injected payload. These results suggest that Shellter software can be an effective tool for evading antivirus software detection, at least at the static scan level. The experiment was repeated using the same payload configuration but with a.raw extension. The results were even more alarming, with half of the tested antiviruses cheated at the static scanning level, and the other half completely fooled, allowing Shellter to establish a connection to the meterpeter console and run directly on the victim's machine. Subsequent testing after an eight-month interval, with updated software and databases, revealed that the antivirus software had improved in detecting the payload. Only AV4 at the static scan level and AV3 at the static scan level and launch level were deceived by the payload based on the.raw extension. Shellter has the potential to deceive signature-based scanning by injecting payloads into countless programs, with each program displaying a different injected payload.