You’re SOL if you’re a spear phishing target. But otherwise?

Also looking bad… Frankly, AVs must fulfill an impossible purpose, and they’re horrible at it. If you ask any AV dev how to bypass their AV at a conference, they can give you a magic file size above which their AV gives up. Don’t wanna tank the performance of your computer, let’s pray that that chunky file is safe. Guess why malware devs deliver their malware in a compressed archive with a suspiciously good compression rate.

Many AV vendors spend a disproportionate amount of time on detection of public toolkits, such as Metasploit. But they suck at detecting everything else, literally. If it’s private, they don’t detect it for a long time. Malware devs have been using the same techniques to evade AVs over and over again, yet they can’t figure out a way to block it. Even if I rig the odds in AVs favor by uploading shit to VirusTotal, only one thinks that my malware with Metasploit payload is malicious, months after the upload.

Now in fairness, VirusTotal only does static analysis. Sucks for AVs that you can call arbitrary, legit functions between malicious ones to confuse the behavioral analysis. Or wait a minute or two for the analysis to give up. Or embed malicious code into legit applications. Or hell, go wild with Java or other more exotic interpreter languages as most AVs don’t check for them at all. Or… hear me out… abuse legit apps for illegitimate purposes! If you’ve got AnyDesk, force it to give the attackers unattended access to your computer.

Thank you for your time, and I hope your trust in AVs is forever shaken. As it should be.