value:  OilRig has tested malware samples to determine AV detection and subsequently modified the samples to ensure AV evasion. ;; Operation Wocao has edited variable names within the Impacket suite to avoid automated detection. ;; Patchwork apparently altered NDiskMonitor samples by adding four bytes of random letters in a likely attempt to change the file hashes. ;; Penquin can remove strings from binaries. ;; PowerSploit's Find-AVSignature AntivirusBypass module can be used to locate single byte anti-virus signatures. ;; SUNBURST source code used generic variable names and pre-obfuscated strings and was likely sanitized of developer comments before being added to SUNSPOT. ;; TEMP.Veles has modified files based on the open-source project cryptcat in an apparent attempt to decrease AV detection rates. ;; Based on comparison of Gazer versions Turla made an effort to obfuscate strings in the malware that could be used as IoCs including the mutex name and named pipe. ;; Waterbear can scramble functions not to be executed again with random values."
name: Obfuscated Files or Information: Indicator Removal From Tools