AVLeak: Fingerprinting Antivirus Emulators for Advanced Malware Evasion
summary
AVLeak is an automated black‑box tool (C core, Python API, Capstone integration) that fingerprints consumer AV emulators—Kaspersky, AVG, Bitdefender engine (used by 20+ products) and VBA—by mapping byte values to distinct malware signatures and compiling/scanning them live. It extracts environment strings, OS API inconsistencies, network emulation, timing skews, process introspection and CPU “red pills” in seconds and compiles evasive droppers; testing of ~30 crafted samples yields a 100% evasion rate. Real artifacts include hard‑coded names and the KL autogenerated DLL marker.
AI-written summary · about
chapters (9)
- 0:00Introduction and background
- 1:45Evasion and prior work
- 3:28Fingerprinting techniques
- 7:08AV leak methodology
- 9:31Live demo and results
- 15:54Malware evasion demo
- 19:01Analyzing AV behavior
- 21:47Findings and conclusions
- 24:57Q&A and closing
related talks
51mFull System Emulation: Achieving Successful Automated Dynamic Analysis of Evasive Malware
26mOne Packer to Rule Them All
45m"Advanced Malware Threat: handling obfuscated code using..."
42mRevealing the Antivirus Quarantined: Using PowerShell to enable Analysis
41mHow AI Is Changing the Malware Landscape
22mMalware Hunting - Using python as an attack weapon
23mThe Convergence Of EBPF, Buildroot, And QEMU For Automated Linux Malware Analysis
33mProactive EDR Against Adaptive Evasion: Countering Self‑Modifying Agentic Malware