# Hackers No Hashing | Huntress

AV vendors detect Cobalt Strike/Metasploit shellcode via default ROR13 API hashes; changing the rotation value and hashes evades detection while shellcode still executes.

- Payout: Research
- Program: Cobalt Strike
- Write-up by: Huntress
- Disclosed: 2022-02-16
- Write-up quality: 7/10
- Original: https://www.huntress.com/blog/hackers-no-hashing-randomizing-api-hashes-to-evade-cobalt-strike-shellcode-detection
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-hackers-no-hashing-randomizing-api-hashes-to-evade-cobalt-strike-shellcode-detection
- Tags: area:os domain:desktop impact:integrity kind:research platform:threat-intel tech:windows technique:reverse-engineering technique:source-review vuln:misconfiguration

**Target:** Windows shellcode (Cobalt Strike/Metasploit) and AV detection engines
**Root cause:** Many AV vendors base Cobalt Strike/Metasploit shellcode detection on the presence of default ROR13 API hashes; changing the rotation constant and recomputing hashes produces new hashes that still resolve, bypassing hash-based detections.
**Steps:**
1. Generate raw shellcode with msfvenom or Cobalt Strike (no encoders), e.g. `--format raw`.
2. Identify ROR13 hashing logic and default hashes (e.g. `0x726774c` LoadLibraryA, `0xa779563a` InternetOpenA).
3. Change rotation value from `0xd`/13 to `0xf`/15 and recompute all API hashes with a script.
4. Replace hashes and rotation value in shellcode; verify APIs still resolve using Speakeasy and call-out with netcat/BlobRunner.
5. To evade remaining generic detections, move the initial `CLD`/`0xfc` instruction, replace it with `NOP`/`0x90`, and uppercase a character in `wininet` to `wIninet`.
6. Submit modified shellcode to VirusTotal; observe reduced detections (e.g. 15 fewer for CS HTTP, 26 fewer for Metasploit TCP bind).
**How found:** Noticed similar malware families use identical hashing logic; googling default hashes (0x726774c) returned Metasploit/Cobalt Strike hits, suggesting vendors key on these hashes. Tested by crudely replacing hashes with 0x11111111, saw 15 vendors fail detection, then refined by changing rotation value to keep code functional.
**Exploitation:** Attacker modifies default ROR13 hashing in commodity shellcode to evade AV detection while preserving functionality, achieving 0/55 VirusTotal detections for Cobalt Strike shellcode after also altering generic shellcode indicators.
**Insight:** When a detection relies on a constant artifact (like a hash), modify the generating algorithm's constant (e.g. ROR rotation) and recompute artifacts to evade while preserving behavior; then hunt remaining generic indicators like initial CLD or stack strings.