Threat Level: green Handler on Duty: Brad Duncan

SANS ISC: Harry Potter and the Rogue anti-virus: Part 1 - SANS Internet Storm Center SANS ISC InfoSec Forums

Watch ISC TV. Great for NOCs, SOCs and Living Rooms:

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Harry Potter and the Rogue anti-virus: Part 1

My colleague Branko and I spent a lot of time reversing various FakeAV/RogueAV copies as we were quite interested in how they manage to constantly have < 5 detections on VirusTotal (and therefore successfully evade detection by normal anti-virus programs).

We noticed that various FakeAV versions use pretty advanced obfuscation, basically anything you can think of: anti-disassembly (destroying functions, opaque predicates, long ROP chains ...), anti-emulation, anti-VM, anti-debugging, even with some bugs of their own.

Branko spent a lot of time analyzing this to improve his Optimice plugin for IDA Pro. If you haven’t heard about it, and you spend a lot of time analyzing malware or reverse engineering binaries, be sure to check it at It’s an amazing tool that can cut down on your time spent on reversing by an order of magnitude.

Below is a screenshot of what Optimice can do – on the left side you can see the original FakeAV code, while on the right you can see the same code after Optimice deobfuscated and optimized it. Much easier to analyze, isn’t it:

Back to FakeAV now – time to explain the title of this diary. While reversing one of the FakeAV copies we noticed that under certain circumstances (when FakeAV is trying to update itself), it basically calls its own binary with a very interesting argument, as you can see in the screenshot below:

Those Harry Potter fans among you probably immediately noticed the argument BOMBARDAMAXIMUM which, according to some online references is “a spell that, being a stronger version of Bombarda, provokes explosions capable of bringing an entire wall down”. I’m not sure which wall this is about, but at least there is some sense of humor here.
If the argument was supplied, the binary will call two functions: the first one will create couple of mutexes, while the second function will connect to a C&C, send some data and (probably – we couldn’t confirm this since the C&C is down) updates itself. This part of code is shown below:

Stay tuned, we’ll post more interesting things in next couple of weeks, including a paper.


I will be teaching next: Web App Penetration Testing and Ethical Hacking - SANS Pen Test Hackfest Europe 2022 - Berlin


403 Posts
ISC Handler
Jun 13th 2011
Good work guys!

This is a plague and I am really interested to see what you chaps end up finding and if there are any recommendations.

Thanks for your work and if there is anything I can do let me know.

Sign Up for Free or Log In to start participating in the conversation!