dobin / avred Goto Github PK

View Code? Open in Web Editor NEW

365.0 9.0 38.0 8.22 MB

Analyse your malware to surgically obfuscate it

Home Page: https://avred.r00ted.ch

License: GNU General Public License v3.0

Python 86.80% HTML 5.74% CSS 7.33% PowerShell 0.01% Dockerfile 0.06% Makefile 0.07%

amsi antivirus antivirus-evasion malware malware-development obfuscation

avred's People

Contributors

Stargazers

Watchers

avred's Issues

ESET scan never ends

When scanning an un-obfuscated "Rubeus.exe", ESET scans forever / or avred continues to be stuck in a loop, and no log files are generated. Rubeus is just used as an example, it does this with every binary I've tested (seatbelt, sharphound, etc).

Do we need to configure specifically for ESET ?

Implement SOCKS5 proxy

Should be able to tunnel via SOCKS5 on server.

NIM compiled binaries fail to parse section.

This issue can be replicated with creating a simple nim program, for eg.

echo "Hello World"

and compiling it with on linux:

nim c --app=console -d:exe -d:mingw --cpu=amd64 -d:debug -d:strip -d:exe --out=helloworld.exe helloworld.nim

scan with avred results in following output:

╰─ python3 ./avred.py --file helloworld.exe                                                                                                                                                                                                                         ─╯
[INFO    ][2023-09-11 14:33:58,601] main() :: Using file: helloworld.exe
[INFO    ][2023-09-11 14:33:58,601] handleFile() :: Handle file: helloworld.exe
[INFO    ][2023-09-11 14:33:58,605] handleFile() :: Using parser for file type EXE
[INFO    ][2023-09-11 14:33:58,647] parseFile() :: Section is invalid, not scanning: .bss addr:0 size:0
[INFO    ][2023-09-11 14:33:58,647] handleFile() :: Using scanner from command line: amsi
[INFO    ][2023-09-11 14:33:58,649] load() :: Loading HashCache
[INFO    ][2023-09-11 14:33:58,650] load() ::   0 hashes loaded
Traceback (most recent call last):
  File "/home/*****/Downloads/avred/./avred.py", line 354, in <module>
    main()
  File "/home//*****//Downloads/avred/./avred.py", line 76, in main
    handleFile(args.file, args, args.server)
  File "/home//*****//Downloads/avred/./avred.py", line 178, in handleFile
    outcome.scanInfo = ScanInfo(scanner.scanner_name, analyzerOptions['scanSpeed'])
                                                      ~~~~~~~~~~~~~~~^^^^^^^^^^^^^
KeyError: 'scanSpeed'

Any other file types work as expected.

Rework windows API

Currently there are two or three windows APIs used:

arch_windows.c: Reflexxion system calls stubs (direct syscalls)
inject/: from go-inject, to perform process injection
syscalls/: from sliver, to perform sliver related stuff like donut shellcode injection

At least merge inject/ and syscalls/. Preferable replace with direct syscalls in pure go, if possible.

dobin / avred Goto Github PK

avred's People

Contributors

Stargazers

Watchers

Forkers

avred's Issues

ESET scan never ends

Implement SOCKS5 proxy

NIM compiled binaries fail to parse section.

Rework windows API

Recommend Projects

React

Vue.js

Typescript

TensorFlow

Django

Laravel

D3

Recommend Topics

javascript

web

server

Machine learning

Visualization

Game

Recommend Org

Facebook

Microsoft

Google

Alibaba

D3

Tencent