# Indicator Removal from Tools

Adversaries may remove indicators from tools if they believe their malicious tool was detected, quarantined, or otherwise curtailed. They can modify the tools by removing the indicator and using the updated version that is no longer detected by the target's defensive systems or subsequent targets that may use similar systems.

A good example of this is when malware is detected with a file signature and quarantined by anti-virus software. An adversary who can determine that the malware was quarantined because of its file signature may modify the file to explicitly avoid that signature, and then re-use the malware.

**Example:**

This demo is very easy to follow Malware usually gets detected because of Signatures, these are in the AV Database and when the malware touches disk the AV compares it signature to its known DataBase.

For example I will grab the hash of a common payload from msfvenom

![](/files/-MRht8IvYhooAzvdrJUq)

Now with a Hex Editor Tool I will change just 1 Hex Decimal and the Hash will completely change

![](/files/-MRht90OnyPjeE7ECSGZ)

Hash has changed

![](/files/-MRht9oamEDfg2QMMvJR)

For Demo purposes I broke the functionality of this payload to demonstrate the hash changing but after some work and testing you can actually change the Hex without breaking functionality. With this there is no need to completely re-write tools or payloads and just remove the offending strings from the binary. In that manner the Hash value will change and be undetectable.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/defense-evasion/t0127-obfuscated-files-or-information/indicator-removal-from-tools.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.