Evading Antivirus Software Detection Using Python and PowerShell Obfuscation Framework

Abstract

Avoiding antivirus detection in penetration testing activities is tricky. The simplest, most effective, and most efficient way is to disguise malicious code. However, the obfuscation process will also be very complex and time-consuming if done manually. To solve this problem, many tools or frameworks on the internet can automate the obfuscation process, but how effective are obfuscation tools to avoid antivirus detection are. This study aimed to provide an overview of the effectiveness of the obfus- cation framework in avoiding antivirus detection. This study used experimental design to test and determine the effectiveness of the payload obfuscation process. The first step was generating Python and PowerShell payloads, followed by the obfuscation process. The results showed that by using the
 right method of obfuscation, malware could become completely undetectable. The automatic obfus- cation process also did not deteriorate the malware’s function. It was proven that the malware could run and open a connection on the server. These findings required more Python obfuscator techniques to determine the effectiveness of the obfuscated payload on the target machines using both static and dynamic analysis