# Antivirus Evasion Methods in Modern Operating Systems
## 6 Experimental Procedures and Results for Antivirus Bypass Mechanisms
Additionally, it pays little attention to the processes it employs, meaning it is able to deceive most static scanners, and potentially can deceive behavioral or heuristic scans. The study demonstrates that Shellter is an effective tool, initially fooling half of the antivirus software tested, but only one after a few months. This underscores the importance of installing appropriate antivirus updates. Veil-Evasion is a framework similar to TheFatRat software that provides numerous solutions for bypassing antivirus security. Veil-Evasion has a significant following on GitHub, but the framework has not been updated since 2020, which may suggest a lack of active development. To test Veil-Evasion's effectiveness, three variants of generated payloads using Msfvenom were selected for study. The Veil-Evasion study was divided into three parts, including testing the basic payload generated in Python, generating the payload based on PowerShell and Bash, and manually editing the previously-generated payload with a hex editor. The results, shown in Table 4, indicate that each tested antivirus was effective in threat detection. Differences were observed in online scans, where the Python-based payload was more frequently detected by antivirus scanners. \begin{table}
\begin{tabular}{l c c c c c c c c c c c c c c} \hline \hline \multirow{3}{*}{**Payload**} & \multirow{3}{*}{**Online Scan**} & \multicolumn{1}{c}{\multirow{3}{*}{**AV1**}} & \multicolumn{1}{c}{\multirow{3}{*}{**AV2**}} & \multicolumn{1}{c}{\multirow{3}{*}{**AV3**}} & \multicolumn{1}{c}{\multirow{3}{*}{**AV4**}} & \multicolumn{1}{c}{\multirow{3}{*}{**AV5**}} & \multicolumn{1}{c}{\multirow{3}{*}{**AV6**}} \\ \cline{3-14} \cline{6-14}  & & **S** & & & & & & & & & & & & & \\ \hline \multicolumn{14}{l}{**Results obtained in January 2022**} \\ \hline
**TheFatRat 62** & 13/26 & Y & Y & Y & Y & Y & Y & Y & Y & Y & Y & **N** & **N** \\ \hline
**ThaFatRat 66** & 10/26 & Y & Y & Y & Y & Y & Y & Y & Y & Y & **N** & Y \\ \hline
**ThaFatRat 61-B** & 9/26 & Y & Y & Y & Y & **N** & Y & Y & **N** & **Y** & **N** & Y \\ \hline
**TheFatRat 61** & 15/26 & Y & Y & Y & Y & Y & Y & Y & Y & Y & Y & Y & Y \\ \hline \multicolumn{14}{l}{**Results obtained in September 2022**} \\ \hline
**TheFatRat 62** & 16/26 & Y & Y & Y & Y & Y & Y & Y & Y & Y & Y & **N** & **N** \\ \hline
**TheFatRat 66** & 14/26 & Y & Y & Y & Y & Y & Y & Y & Y & Y & Y & Y \\ \hline
**TheFatRat 61-B** & 13/26 & Y & Y & Y & Y & Y & Y & Y & Y & Y & Y & Y \\ \hline
**TheFatRat 61** & 14/26 & Y & Y & Y & Y & Y & Y & Y & Y & Y & Y & Y \\ \hline \multicolumn{14}{l}{Note: 62 - C+PowerShell; 66 - C; 61 - bat+PowerShell; B - Port 4444.} \\ \end{tabular}
\end{table} 
Table 2: TheFatRat results. The other two payloads had similar results, but an interesting situation emerged in re-testing after eight months with up-to-date antiviruses. As expected, more scanners detected the threat, but during this period, the payload generated with PowerShell and Bash was caught by one more scanner than the one that was manually edited in the hex. This finding suggests that some antivirus software did not receive an update, or it may be a distortion from the online scan site. In order to be comparable to previous research and to allow for other researchers to reconstruct the authors' tests, the criteria for assessing the effectiveness of the masking tool and antivirus software are similar to those described in previous research. Assigning penalty points for failure to detect malware in static and dynamic scan is a state-of-the-art methodology and thus was used in the research. Instead of using quality measurements or other kinds of rankings, penalty points are direct values that can be compared with past research and can be used by other researchers or in future work. If the antivirus does not detect the malware during the static scan level, it receives one penalty point. If the antivirus does not detect the malware during the static and dynamic scan levels, it receives two penalty points.