Adding antivirus exception

Created the Monday 18 March 2019. Updated 1 day, 15 hours ago.

This technique involves searching for active antivirus-related processes or modules and terminating execution if any are found. By detecting loaded antivirus libraries, malware can determine whether it is running in a monitored environment and exit to avoid detection.

Technique Identifier

U0507

Code Snippets

import ctypes
import psutil
import sys

def is_av_present():
    av_signatures = [
        "avghookx.dll", "avghooka.dll",  # AVG
        "snxhk.dll", "sf2.dll",  # Avast
        "sbiedll.dll",  # Sandboxie
        "dbghelp.dll",  # WindBG, WINE
        "api_log.dll", "dir_watch.dll",  # iDefense Lab
        "pstorec.dll",  # SunBelt Sandbox
        "vmcheck.dll",  # Virtual PC
        "wpespy.dll",  # WPE Pro
        "cmdvrt64.dll", "cmdvrt32.dll",  # Comodo Container
        "sxin.dll",  # 360 SOFTWARE
        "printfhelp.dll",  # Unknown Sandbox
        "ekrn.exe",  # ESET
        "avguard.exe", "avscan.exe",  # Avira
        "ccSvcHst.exe", "norton.exe",  # Norton
        "mcshield.exe", "mcupdate.exe",  # McAfee
        "fsav.exe", "fsgk32.exe",  # F-Secure
        "kav.exe", "kavsvc.exe",  # Kaspersky
        "msmpeng.exe", "mpcmdrun.exe"  # Windows Defender
    ]

    for proc in psutil.process_iter(attrs=['pid', 'name']):
        try:
            if any(av.lower() in proc.info['name'].lower() for av in av_signatures):
                print(f"Detected AV process: {proc.info['name']} (PID: {proc.info['pid']})")
                return True
        except (psutil.NoSuchProcess, psutil.AccessDenied, psutil.ZombieProcess):
            pass
    return False

if is_av_present():
    print("Antivirus detected! Exiting process to avoid detection.")
    sys.exit(0)

print("No antivirus detected. Proceeding with execution.")

About Author Open Snippet

Author: Diyar Saadi (Malfav.Win32) / Target Platform: Windows

Contributor

Diyar Saadi (Malfav.Win32)

Additional Resources

External Links

The resources provided below are associated links that will give you even more detailed information and research on current evasion technique. It is important to note that, while these resources may be helpful, it is important to exercise caution when following external links. As always, be careful when clicking on links from unknown sources, as they may lead to malicious content.

Malware Writers Using Exclusion Lists To Linger - Darknet