How can Antivirus differentiate between a Trojan and a normal remote desktop application software?

Question

RAT (Remote Access Tool, e.g. Sub7) are considered malicious by Antivirus software. How can it distinguish between such patches and a client application for commercial software like NetSupport School?!

score 11 · Answer 1 · answered Apr 18 '13 at 14:32

Despite outrageous marketing claims to the contrary, antivirus software is not smart. Antivirus does not recognize "types" of software, as in "mmh... this looks like a tool for RAT". There are strong theoretical reasons why this sort of detection is, in all generality, impossible to achieve, and correspondingly very hard to do in practice.

What antivirus does is to look up the software they see (which is, ultimately, a sequence of bytes) in a big database of "known evil software". The antivirus vendor works hard, every day, to include in that database malware which has been observed in the wild -- i.e. most malware you are likely to encounter, but not Net support school software, which the human antivirus vendor are deemed "not evil".

To add to this, sometimes they may recognize common methods to try and hide from antivirus. If you had benign software, but wrapped it up in a way that virus's usually do, it may be flagged. — Peleus, Apr 19 '13 at 04:50

score 3 · Answer 2 · answered Apr 19 '13 at 03:54

Most of the time the vendor who develop the IT support tools work with the AV companies in order to white list their remote administration tools.

The behavior detection a.k.a the hueristic engine of AVs are marketed by the antivirus companies as a super genius mechanism of detecting trojans and other malware even if there is no signature available. Technically hueristic engine is nothing more than DLL hooking for detecting when processes call VirtualAlloc(), VirtualProtect(), GetProcAddress(), LoadLibrary() etc.

Therefore, from an antivirus point of view, there is no difference between a legitimate remote administration tool or a malicious one. The code for both of them is almost the same. The only thing the AV looks for is to see if the software is in the allowed application list. If it is, then it is allowed. Otherwise, the tool will be flagged as suspecious/malicious.

this is an incredibly good answer – atdre Apr 09 '15 at 19:03 — atdre, Apr 09 '15 at 19:03

Dr.Ü · Answer 3 · 2013-04-18T14:43:50.847

1

Afaik based on whitelisted signatures. I hazard a guess based on Teamviewr (they like to know pretty much about the manufacturer of the AV).

edited Apr 18 '13 at 14:43

answered Apr 18 '13 at 14:32

Dr.Ü

1,029
8
16

score 1 · Accepted Answer · answered Apr 18 '13 at 18:24

Some anti-virus will distinguish RAT from NetSupport tools. It depends of the type of the detection mechanism that the anti-virus is using.

If the anti-virus is using a signature-based detection, it should distinguish a RAT from NetSupport since it is looking for specific lines of code. This type of protection depends on the quality of the signatures in the database. If the virus is not in the database, the virus won't be detected.

If the anti-virus is using a heuristic-based detection it will look for suspicious application behavior, thus it may not distinguish a RAT from NetSupport tools.

How can Antivirus differentiate between a Trojan and a normal remote desktop application software?

4 Answers4