Hack Like a Pro: How Antivirus Software Works & How to Evade It, Pt. 3 (Creating a Malware Signature in ClamAV) « Null Byte :: WonderHowTo

Welcome back, my budding hackers!Inthis series, we are trying to understand how AV software works so that we can learn to evade it. To that end, we are working with the open-source AV software, ClamAV. I had previously introduced ClamAV inPart 2 of this series. If you have not installed it yet, go back to that and install it.To understand how AV works, we will be building our own malware signatures in this tutorial. The more we know how these signatures work, the better we can develop methods to evade them.Step 1: Fire Up Kali & Open ClamAVIn my previous tutorial, we hadinstalled ClamAV in our Kali system. Also, remember that I had showed you how to use sigtool to unpack the malware signatures.Let's navigate to the ClamAV directory:kali > cd clamav-0.98.7Step 2: Create an ASCII-Based SignatureLet's assume that a newly discovered bit of malware has a unique signature that we can identify. We have isolated and disassembled it. Furthermore, let's assume that the signature is in ASCII. Next, let's assume that the ASCII signature isnullbyte. If we want to create a signature then for that malware, the first thing we would need to do is to convert that ASCII signature to hex.Sigtool is a tool unique to ClamAV that enables us to work with malware signatures (hence the namesignature tool). Let's use that tool to create hexadecimal signature ofnullbyte. The syntax is simple and straightforward. Simply type the commandsigtoolfollowed by the--hex-dumpswitch. Hitenter, then input the ASCII you want converted to hex.kali > sigtool --hex-dumpnullbyteNote that after enteringnullbyteas my signature, I hitenterand then sigtool generated the hexadecimal representation of it. Unfortunately, it took as input bothnullbyteand the control character0a, which is for when I hit theenterkey signifying the end of one line and the start of another. (In Windows, this would be0d0a, a combination of the CR (carriage return) and LF (line feed) characters.)If we are to use this signature effectively in ClamAV, we need to truncate that 0a off the end, so that our signature becomes:6e756c6c62797465Step 3: Signature FormatNext, we want to create a malware signature file. The basic signature format in .ndb files is:SigName:Target:Offset:HexadecimalSignatureLet's break that down to better understand:SigNameis a unique ASCII name or label of the signature file.Targetis the type of file. (See the table below.)Offsetis the number of bytes from the start of the file to look for the signature.HexadecimalSignatureis the hex representation of the signature of the malware.TheTargetparameter is one of the following:0 = any file type1= Windows PE2 = OLE3 = normalized HTML4 = email5 = image files6= ELF7 = normalized ASCII8 = unused9 = Mach-O binariesIf we want to now use the hex signature we created in the Step #2 to look for that ASCII string in any file, we could create signature file like:NullByte:0:*:6e756c6c62797465Let's break this one down now:NullByteis the unique name of the signature.0indicates look for the string in ANY file type.* indicates any offset (this is a wildcard meaning any).6e756c6c62797465is the hex representation of the signature.We must then enter that signature into the main.ndb file in ClamAV for it to be used by the AV application. Open main.ndb in any text editor and place the signature into the file and save.Step 4: Test Whether Our Signature WorksClamAV has a utility calledclamscanthat enables us to test a signature file, but before we do that, we must create our malware file. Let's use any text editor to create a malware file with the signaturenullbyte. I have created one below using Leafpad. Note that it includes the signaturenullbyte.I saved this file in/root/clamav-0.98.7/database, but you can save it anywhere, just remember the full path to it.Now, we can test whether our malware signature file will be detected by ClamAV by using clamscan. Clamscan simply takes the-dswitch, for detect, and the signature file followed by the malware file.kali > clamscan -d /root/clamscan-0.98.7/database/main.ndb /root/clamscan-0.98.7/database/nullbyte-malwareAs we see above, ClamAV detected our malware!Step 5: A Touch More Complex SignatureIn Step #3, we used a simple signature of ASCII looking for the wordnullbyte. What if the malware included bothnullandbyte, but not necessarily together?First, we would need to break up our hex representation into two separate pieces, one representingnulland one representingbyte. Since the hex representation is simply a character for character "translation" with each ASCII character represented by two hex characters, we can assume that the first eight hex characters representnulland the second eight characters representbyte. Let's check to make sure and enternullinto our sigtool and see what it spits out.As you can see, when the sigtool converted the ASCIInullto hex, it spit out the first eight characters of our original hex signature with the 0a tacked on the end to represent theenterkey. So, now we know we can create a new signature using both words and look for them in different places in the file.Step 6: Create a Signature Looking for Null & ByteNow, let's create a signature looking for the wordsnullandbyte, but not necessarily together. ClamAV has a number of wild cards we can use. In this case, let's use the wild card??. This wildcard represents any number of bytes between 0 and 255 (0-FF). If we put it betweennullandbyte, it will look for those two words together (0 bytes between) or up to 255 bytes between them (FF bytes between). We can now rewrite our signature as:NullByte:0:*:6e756c6c??62797465Step 7: Using OffsetsOne of the arts of writing good signatures is to make them as efficient as possible. AV software that has to look at every byte of every file would be VERY sloooooow. To make our signature a bit more efficient, rather than having ClamAV look throughout the entire file (0 offset), we can specify where it should look in the file for the signature. This obviously would be far more efficient. Of course, it assumes that we know where the signature is in the file, and usually, we will.Let's assume that we know that the two signature wordsnullandbytenever occur before the 69th byte. Where previous we had used the wildcard * in the offset field, we can be more specific and ONLY look in the 69th byte. We can rewrite our signature as:NullByte:0:69:6e756c6c??62797465Notice that we replaced the wildcard in the Offset field with69.Furthermore, we might know that the signature words never occur after the 99th byte. We can then put in a range of offset values so that ClamAV only looks in the 69th through the 99th bytes by rewriting our signature as:NullByte:0:69,99:6e756c6c??62797465Note that in the offset section of the signature, we have the value of the first byte, 69, followed by the last byte, 99, with a comma separating them.Now that we have learned to write a simple malware signature in ClamAV, we will work toward writing more advanced signatures in this series. Keep coming back, my budding hackers!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image viaShutterstockRelatedHack Like a Pro:How Antivirus Software Works & How to Evade It, Pt. 2 (Dissecting ClamAV)Hack Like a Pro:How to Change the Signature of Metasploit Payloads to Evade Antivirus DetectionHack Like a Pro:How Antivirus Software Works & How to Evade It, Pt. 1Hack Like a Pro:How to Bypass Antivirus Software by Disguising an Exploit's SignatureHacking macOS:How to Create an Undetectable PayloadAdvice from a Real Hacker:How to Know if You've Been HackedHack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 1 (Tools & Techniques)Hack Like a Pro:How to Evade AV Software with ShellterHow To:Remove the Palladium Pro rogue malware from your computerHow To:Use MSFconsole's Generate Command to Obfuscate Payloads & Evade Antivirus DetectionHow To:The Definitive Guide to Android MalwareBest Android Antivirus:Avast vs. AVG vs. Kaspersky vs. McAfeeHack Like a Pro:Metasploit for the Aspiring Hacker, Part 5 (Msfvenom)Hack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 6 (Using IDA Pro)How To:Security-Oriented C Tutorial 0xFB - A Simple CrypterNews:New Android Malware Is Emptying People's Bank Accounts—Here's How to Protect YourselfHow To:Android's Built-In Scanner Only Catches 15% of Malicious Apps—Protect Yourself with One of These Better AlternativesHow To:Security-Oriented C Tutorial 0xFF - An Introduction to MalwareHow To:How Hackers Stole Your Credit Card Data in the Cyber Attack on Target StoresHow To:Remove the MS Removal Tool malware from your PCHack Like a Pro:How to Evade AV Detection with Veil-EvasionHow To:Anti-Virus in Kali LinuxHow To:3 Reasons You Still Need a Good Antivirus App on AndroidNews:Malware Targets Mac Users Through Well-Played Phishing AttackHow To:Remove Personal Antivirus from your Windows PCNews:Samsung Preinstalls McAfee Bloatware on Your S8 & It's Neither Great nor FreeHacking Windows 10:How to Break into Somebody's Computer Without a Password (Exploiting the System)Advice from a Real Hacker:How to Protect Yourself from Being HackedHow To:5 Reasons You Should Use Be Using Norton Mobile Security on Your Android DeviceHow To:If You're Seeing Lock Screen 'DU' Malware When Charging, Uninstall These Apps Right NowNews:What to Expect from Null Byte in 2015Hack Like a Pro:Capturing Zero-Day Exploits in the Wild with a Dionaea Honeypot, Part 1Lockdown:The InfoSecurity Guide to Securing Your Computer, Part IHow To:Scan for Viruses in Windows Using a Linux Live CD/USBNews:What does Pro Tools HD Native mean for you?Windows Security:Software LevelNews:Half a Million Macs Affected by Flashback Trojan! Eradicate It Before It's Too LateHow To:Mac OS X Hit Again! How to Find and Delete the New SabPub MalwareHow To:Get Rid of Even the Most Extreme Malware and Spyware on Your Grandma's PCNews:2,000 FREE Scrabble Apps (iOS) from EA on Facebook & Twitter — ENDS TODAY!