Hey everyone,

I was just wondering if AV vendors have the possibility to add signatures based on the structure of how a program is set up?

For instance, I’ve recently done some tests on obfuscating the source code of a widely-known RAT found on GitHub. I’ve renamed all of the strings, methods, classes and namespaces. Disabled/commented out some functionality I don’t need, even obfuscated the DLL assemblies as well.

Though for some reason, AV vendors still detect it. Maybe I’m missing a spot in the code where another signature is, or perhaps, it’s the structure of the code itself that’s getting detected?

I don’t know how many vendors use behavioral analysis, but maybe the detection lies in that area of antivirus solutions?

​

How much obfuscation or code changing is enough for you guys to bypass most AV’s?