Posted on by

AntiVirus Evasion With Exocet

Hello aspiring Ethical Hackers. In this article, you will learn about AntiVirus Evasion with the help of a tool named Exocet. Exocet is a Crypter type malware dropper. A Crypter is a software that is used to make malware undetectable. It performs functions such as encrypting, obfuscating and manipulating the code of the malware to make it undetectable.

EXOCET is one such Crypter-type malware dropper that can be used to recycle easily detectable malware payloads. EXOCET achieves this by encrypting those malware files using AES-GCM (Galois/Counter Mode) and then create a dropper file for a majority of target architectures and platforms.

Written in Golang programming language, the steps involved in making malware undetectable by EXOCET are,

  1. It first takes malware that is easily detectable by Anti Virus engines as input.
  2. It then encrypts this easily detectable malware and produces it’s own Go file.
  3. This Go file can be cross-compiled to 99% of known architectures like Linux, Windows, Macs, Unix, Android and IPhone etc.
  4. Upon execution, the encrypted payload is written to the disk and immediately executed on the command line.

Let’s see how it works. First, we need to install Golang on Kali as Exocet is a Go program.

Exocet 1

Once Golang is successfully installed, clone the repository of Exocet. It can be downloaded from here.

Exocet 2
Exocet 3

We need to install the EXOCET source files in golang. We can do this using the command shown below.

Exocet 4

Exocet is successfully installed. Now, let’s test it. We create a reverse shell payload with Msfvenom first.

Exocet 5

We copy this payload to our target system which is Windows 10. The Windows Defender easily detects it (obviously) and classifies it as malware.

Exocet 6 1024x499

This is expected. Next, We copy this easily detectable payload to the directory of Exocet.

Exocet 7

Then we run the following command using Exocet. This will create a new golang file called outputmalware.go.

Exocet 8
Exocet 9

Then we run the following command to create a Windows 64 bit payload.

av evasion
Exocet 11

Our result is the exocet_payload.exe. We start a Metasploit listener on the attacker system and copy the Exocet payload to the target.

Exocet 12

This time the payload goes undetected as shown below.

Exocet 15 1024x549

This is how we perform AntiVirus Evasion with Exocet Tool.

Follow Us