1. Crypters/Binders.
This is By far the most Common Way to Make Your Trojan Undetectable.
Almost everyone Who Makes There Trojans Undetectable Uses a Public Crypter, My First Public Crypter, was “Deamon Crypt” I’m sure almost everyone has used that, at least once. As Most of you know, Public Crypters are useless, Unless there Released On the day you find it, or its a VIP/Modded Version. If you want a Good Crypter, its Best just to Buy one From the Blackmarket, And scan on AV Web scanning sites, Making sure You dont Distribute The Outcome. Also, don’t forget, that a File Needs To be “Unpacked” Before Crypting, Or it may Corrupt the file. And Crypters Now-a-days, Have “Anti’s” Meaning it can Get past Virtual machines and Sandboxes. They also have “EOF Data Support” Meaning.. Most Trojans Have EOF Data, If Your Crypter doesnt Support EOF, then the EOF Data Trojan Simply will corrupt, because its not compatible.
2. Packers.
Packers are Like Crypters, except they change the file size in some way, I personally Have never used Packers, But from my opinion, they are very Similar. They Make Your Crypter Undetectable.
3. Hex Editing.
Ahhh, Hexing, Boring and in Most Cases a waste of time. Why? Because not only is it Very Fustrating and can take a long time, But you can see Your trojan either being very Uneffective (meaning some Functions may not work) and it can also Corrupt it. There are 2 ways i know of, that can be used for Hexing,
1. Splitting the file.
2. Using a program to find the Offsets.
(these auto find the Virus signatures, so you dont have to split the file and manually find the signatures)
Anti virus is moving on now though, They use Heuristic, Which is far more advanced. So Signature editing may one day, become useless.
Hexing is also only Undetectable at scantime, so in my opinion, its useless.. I mean.. whats the point in hexing a file if, when the person runs the file, its just gonna get deleted when they run it, because the AV catches the virus at runtime. But it is good for people who dont have Anti virus and scan it on AV Websites, this isnt such a good idea though. Because they will just send the results to AV Vendor’s…
4. Byte adder’s.
Bytes adding, is an old method that usually Doesnt work anymore, Although it can still throw off a few AV’s, Basically It Adds Junk Data to the end of a file and makes the File Size Bigger also. I Personally dont see how this can Affect confusion to an AV. You can either do it manually with a hex editor, Or you can use a program to do it for you..
Heres one..
http://ssteam.ws/security-tools/480-exe-byte-adder.html
5. Exe Scrambler’s
Another method, which may or may not work, I’m not entirely sure because I’ve never done it, But its possible to scramble the whole exe file with programs. This in my opinion corrupt the whole file. But I’m not sure.
Exe scramblers are available on all Hacking Sites.
6. Entry Point Changing
This is Not so easy to do, It involves Mathermatic’s, Base 16 Knowledge, and Assembly, This basically Involves Changing the origin of the file, every file has a starting Point, Changing the starting Point of a file can confuse an AV. Although this method doesnt work much anymore, But can be usefull with more advanced methods.
7. Source Modding.
If you have the source code of a Trojan/Crypter You can Mod it, You would Mod the source of the server (Trojan) and the stub (Crypter)
Modding is basically Changing Functions around, and adding comments. You may also change strings around.
This is Very Very effective and works so easily.
8. Decompiling.
Decompiling a source is like stealing a source code, The only Problem is, is that when You decompile a source, it looks like its in another language, Thats because Its in assembly Language. Im not sure what you can achieve from this, But im pretty sure You could change some of the code around and Mod it, Like in the Previous example.
Im sure there are Loads loads more ways, But these are the Most Obvious
Credits: ELITEXBYTES