I'd like to verify that my payload won't get caught by any AVs and ideally EDRs. One way to do this is of course uploading it to VirusTotal and having it scan / check against popular anti virus engines.
Of course, the risk here is that submitting a sample to VT might blow your cover and have your sample end up in those very AV databases. Most evasion tools such as veil evasion or hyperion advise against submitting to VT.
One option is to purchase a subscription to each AV you're interested in testing against, installing them on a VM and scanning your sample with the network connection disabled. I assume someone has made a tool for this and I don't need to do this myself.
I've search and both Malice and MalwareMultiScan are tools to do just this. However, both are no longer maintained. In fact, MalwareMultiScan mentions in its readme that is was created because Malice is no longer functional.
VirusTotal does seem to offer a private scan but apparently this doesn't actually give you the AV verdicts:
Note that private analyses won't contain antivirus verdicts, they will contain only the output of all the other characterization and contextualization tools that we run, including sandboxes.
So that's useful, but not quite what we're looking for. I'd even be fine if it submitted the sample after a few days. After all, I'm not looking to develop malware that stays undetected indefinitely (although it would be nice if it did) and I accept this is inevitably a cat and mouse game.
There's a similar question here but many of the tools suggested are similarly maintained. I suspect this may have to do with them being abused by the actual bad guys? Or maybe it's just that security folks aren't super interested in maintaining tools like this long term. There's definitely an ethical question of whether providing this sort of capability to anyone helps the "bad guys" more than the "good guys" but I think you can ask that question about most tools a red team would use. Is there something ethically different about maintain an AV scanner than there is maintaining a tool to evade AVs? Regardless:
How do the legit red team or pentesters do it? How do the bad guys do it? Surely their methods can't differ too much. Is spinning up VMs with your AV of choice the way to go? That does seem like the most fool / future proof method of testing a payload's detection.
