# Antivirus Evasion Methods in Modern Operating Systems
## 5 Research Environment and Toolset
### Antivirus Evasion Frameworks
After selecting the desired option, the user is prompted to enter the IP and port for the attack, as well as the name of the output file. Depending on the option selected, the program may also require the user to choose the appropriate type of payload. Shellter [46] is a software tool that facilitates the dynamic injection of a payload into a secure executable file. Payloads can be either created in Shellter or generated with other tools such as Msfvenom. However, it should be noted that Shellter is currently limited to supporting the injection of code only into 32-bit applications [47]. The installation of Shellter requires the previously-described Wine [42] package to be installed again. The Shellter tool can be installed by running the install command in the terminal. After installation, the program can be initiated by running the Shellter command, which opens the program window. The user must then choose whether to use automatic or manual mode. For this study, the focus was on the automatic mode to demonstrate the ease of use of the tools employed. Next, the user selects the file to which the previously-generated payload will be injected. The program then prompts the user to enable \"stealth mode\", which ensures the proper operation of the infected program. Since the attacker typically wants the attack to go unnoticed, the user selects the 'Y' option. Following this, the program presents the option to use pre-existing payloads available in Shellter or to use the previously-generated payload. If the user chooses to use their payload, they can indicate it at this point. However, if a payload from the pre-existing list, such as the reverse_tcp interpreter, is selected, the user must then indicate the host's IP and port. Veil-Evasion [48] is a Python-based framework widely used to create payloads, which can effectively bypass antivirus protections [49]. It was designed to operate on Kali Linux, making installation a straightforward process by entering an install command in the terminal. Once installed, the program can be started by typing the command \"veil\" in the console, which launches the program window displaying two tools. The tool of interest in this context is the Veil-Evasion option, which provides over 41 payloads, divided into 10 different programming languages, including C, PowerShell, Python, Ruby, and AutoIt. The user can list the payloads by using the \"list\" command and then selecting the desired payload using the \"x\" command, where \"x\" represents the assigned number of the payload. After selecting the payload, a window with various options for the generated payload appears, enabling the user to modify the payload to make it more unique and resistant to antivirus scanners. For payloads with a meterpreter console and reverse TCP connection, the required options are LHOST and LPORT, while Veil-Exploit offers many other optional settings. These include the use of an encoder, RAM checks, and the clicktrack option, which only launches the payload after a specific number of mouse clicks by the victim. After modifying the payload as per the attacker's requirements, the \"generate\" command generates the payload, and the user can specify the name of the output file and the desired extension.