[ApexLead]

Hello guys,
After a while of playing with exploits & RATs I started wondering - is the location of the file (the file that the exploit downloads and executes) relevant for the detection of the file?
I mean does it make the RAT more detectable when downloading because of the URL (Http/Https, Known site, etc.)? Or maybe some hosting sites distributes files uploaded to them? Like if I upload to a web host of mine for researching

Thanks :)

[Blazed]

Good question. I also wonder if the url used changes something, I guess if it contains words like fileshare it must be a red flag, no?

[M3LT]

yeh, antiviruses will add to your files "threat score" if they detect url strings in your file, you need to encrypt them with a xor key etc. or you will get scan time detections.

[H.A.A.R.P]

thank you sir good jop 😏 😏

[ProtectNull™]

Yes and no,

1) Some antiviruses can detect the string of your file. (URL)
2) During runtime, some AV's have debugging techniques and still detect the file URL (decrypted)
3) Where you host it does matter, for example, Malwarebytes Proactive Detection.


And many more.

[ApexLead]

Yes and no,

1) Some antiviruses can detect the string of your file. (URL)
2) During runtime, some AV's have debugging techniques and still detect the file URL (decrypted)
3) Where you host it does matter, for example, Malwarebytes Proactive Detection.


And many more.

So if my file is totally FUD when i download it manually, but gets detected on ST after an exploits download it, what do you think happens?
I would guess it's not because of the URL because it already downloaded it plus when i download it manually the AV doesn't alert on anything, can it be because of the file's saved location on the computer?

And about answer 3, you mean that the host has Malwarebytes Proactive Detection or another AV installed? And if so how does it affect my PC's AV?

Thanks a lot mate

[ProtectNull™]

I don't really understand what you mean.

But the downloader itself, lets say its FUD. When it runs and downloads from URL (runtime) it can be detected by AV's because; (1) The host is flagged by the AV like Malwarebytes Proactive. (2) The location you are saving it on (depends if your file is ran by admin). (3) If the file your dropping isn't FUD.

Not sure what you mean by the last question either.

[ApexLead]

I don't really understand what you mean.

But the downloader itself, lets say its FUD. When it runs and downloads from URL (runtime) it can be detected by AV's because; (1) The host is flagged by the AV like Malwarebytes Proactive. (2) The location you are saving it on (depends if your file is ran by admin). (3) If the file your dropping isn't FUD.

Not sure what you mean by the last question either.

What I mean is that the exe is FUD, if I download it manually and scan it with the AV the AV says it's clean, but when the exploit downloads it, a few seconds after it's downloaded the AV detects the exe on ST (Not the exploit on RT - the exploit is FUD and not flagged at any point).

So the only option I see is because the exploit saves it to TEMP and tries to run it from there because that's the only difference I see between the exploit and manually downloading, can the saved location alone be the cause?

[ProtectNull™]

What I mean is that the exe is FUD, if I download it manually and scan it with the AV the AV says it's clean, but when the exploit downloads it, a few seconds after it's downloaded the AV detects the exe on ST (Not the exploit on RT - the exploit is FUD and not flagged at any point).

So the only option I see is because the exploit saves it to TEMP and tries to run it from there because that's the only difference I see between the exploit and manually downloading, can the saved location alone be the cause?

TEMP / Appdata is commonly dropped, so AV's are watching these directories often.

There is a way to actually bypass runtime/scan time for Download & Execute but I'll be using it maybe when I sell something, but It is possible.