Procedure examples

The author of GravityRAT submitted samples to VirusTotal for testing, showing that the author modified the code to try to hide the DDE object in a different part of the document.

InvisiMole has undergone regular technical improvements in an attempt to evade detection.

Cobalt Strike includes a capability to modify the Beacon payload to eliminate known signatures or unpacking methods.

SUNBURST source code used generic variable names and pre-obfuscated strings, and was likely sanitized of developer comments before being added to SUNSPOT.

Analysis of Daserf has shown that it regularly undergoes technical improvements to evade anti-virus detection.

Penquin can remove strings from binaries.

QakBot can make small changes to itself in order to change its checksum and hash value.

Waterbear can scramble functions not to be executed again with random values.

PowerSploit's Find-AVSignature AntivirusBypass module can be used to locate single byte anti-virus signatures.