Ways of lowering entropy on malware

[carbanak666]

Are there any consistent ways of lowering entropy on a malware?

Any material I can read to get a better understading of how to do this?

 

[PlagueMalware]

Hi friend! Glad to see people looking into topics like this more. To reduce the entropy in your malware, there are a general few best practices:

1. Limit the use of AES - Tbh, you can get payload encryption done pretty handily using XOR to decrypt (make sure to fetch from a remote source).

2. Increase what you can control, aka known data - You can lower the overall entropy of your binary by "packing" it with all sorts of things that are a const variable. Some like to use words from the dictionary, song lyrics, or some other thing!

3. Embed legit data in .rsrc - Use resource hacker and add some good data from a viable binary! This can help in more than just entropy.

Hope this helps you get started

 

[carbanak666]

Hi friend! Glad to see people looking into topics like this more. To reduce the entropy in your malware, there are a general few best practices:

1. Limit the use of AES - Tbh, you can get payload encryption done pretty handily using XOR to decrypt (make sure to fetch from a remote source).

2. Increase what you can control, aka known data - You can lower the overall entropy of your binary by "packing" it with all sorts of things that are a const variable. Some like to use words from the dictionary, song lyrics, or some other thing!

3. Embed legit data in .rsrc - Use resource hacker and add some good data from a viable binary! This can help in more than just entropy.

Hope this helps you get started

Thanks bro, It sures help! I'll start looking into these things you mentioned!! Ty again

 

[phant0m]

You can use XOR and its going to drop entropy detection. Keep in mind that if you use any kind of encryption, you can expect entropy detection on your file.

 

[carbanak666]

You can use XOR and its going to drop entropy detection. Keep in mind that if you use any kind of encryption, you can expect entropy detection on your file.

Im using XOR already, minimum entropy I could reach was 4 or 5. Any ideas of bypassing AV/EDR without encrypting the shit out of everything?
Crowdstrike Falcon always get me

Anyone worked with carbon black before? I'd could use some tips on this topic too hehe

 

[PlagueMalware]

Im using XOR already, minimum entropy I could reach was 4 or 5. Any ideas of bypassing AV/EDR without encrypting the shit out of everything?
Crowdstrike Falcon always get me

Anyone worked with carbon black before? I'd could use some tips on this topic too hehe

Falcon hates injection

 

[AMD64]

learn what is entropy.
Use base64 or BinToHex after any encryption.