![]() |
|
[C#] How to bypass agentTesla!ml detection? - Printable Version +- Hack Forums (https://hackforums.net) +-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444) +--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151) +---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118) +---- Thread: [C#] How to bypass agentTesla!ml detection? (/showthread.php?tid=6263504) |
How to bypass agentTesla!ml detection? - onledej03 - Feb 11, 2024 I can't bypass the agentTesla!ml detection. all my code is methods that return the byte[] or string parts of the payload, the launch method, the decryption method, and the amsi bypass method. Code using System; (I shortened the bytecode and key) sometimes I get Wacatac or Sabtic. why? do I need to use an icon and change the assembly information RE: How to bypass agentTesla!ml detection? - stdio - Feb 12, 2024 These are generic detections based on machine learning, adding icon or modifying assembly won't help much. Try introducing junk code, put delays, alternate execution, multi threats ;) RE: How to bypass agentTesla!ml detection? - Klonopin - Feb 12, 2024 create separate processes for different stages of your payload execution or communicate between processes to distribute the workload. This can confuse sandbox environments and ML-AVs that rely on monitoring process behavior. since ML-AVs analyze behavior, try to mimic the behavior of legitimate applications or known benign software to reduce the chances of triggering ML-AV alerts. RE: How to bypass agentTesla!ml detection? - Menalix - Feb 19, 2024 having win32 api imports is never a good idea. is it scan time or run time? RE: How to bypass agentTesla!ml detection? - onledej03 - Feb 23, 2024 (Feb 19, 2024 02:57 PM)Menalix Wrote: having win32 api imports is never a good idea. scan and runtime (Feb 12, 2024 04:29 PM)Klonopin Wrote: create separate processes for different stages of your payload execution or communicate between processes to distribute the workload. This can confuse sandbox environments and ML-AVs that rely on monitoring process behavior. since ML-AVs analyze behavior, try to mimic the behavior of legitimate applications or known benign software to reduce the chances of triggering ML-AV alerts. thanks RE: How to bypass agentTesla!ml detection? - Menalix - Feb 23, 2024 (Feb 23, 2024 12:21 PM)onledej03 Wrote: scan and runtime k get rid of the winapi's Manual map the amsi.dll Also getprocaddress is essentially just an export address resolver by looping the export table, which again is super easy and a few lines of code to do yourself. In general you want the least amount of data you can't manipulate. Then there is VirtualProtect use your manual coded getprocaddress resolver to get the export address in the pre-loaded kernel32 which windows loader always load in all processes and call it dynamically. FromBase64String call its also stupid, write your own simple text encoder instead. My guess atm is you partially get heuristically flagged because of a IAT sig. Otherwise your way of loading the assembly which is not a runpe. I would advice you to use an unmanaged runpe easyier to keep undetected and running as a legit other process also looks better. |