+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+----- Forum: Hacking Tutorials (https://hackforums.net/forumdisplay.php?fid=47)
+----- Thread: [Tutorial]How to make your Server.exe FuD [NO Crypter Needed!] (/showthread.php?tid=1295151)
* - xSkid - May 18, 2011
(May 18, 2011 08:05 AM)dkc379 Wrote: Umm, Guys You Have To Try All Three Steps To make It Undectatable !
Yeah that is correct.
Thanks for your help.
* - Hotman - May 18, 2011
Your tutorial is very friendly with noobs and attractive. I like it 😉 . Nice job keep working like this mate 😅 !
* - xSkid - May 18, 2011
(May 18, 2011 03:51 PM)Hotman Wrote: Your tutorial is very friendly with noobs and attractive. I like it 😉 . Nice job keep working like this mate 😅 !
Thank You ;)
Also thank you for taking the time to actually post a comment,
unlike the rest of the 500+ user's who didnt.
* - Rukkas - May 18, 2011
So. Here is what i did. I used a stub that was completely FUD.
Quote:File Info
Report date: 2011-05-18 19:38:30 (GMT 1)
File name: stub-exe
File size: 65024 bytes
MD5 Hash: 62ae63ec413989267afac94021ac4c77
SHA1 Hash: cb8979b1917df0ad36e3a330488538ac0fe4758f
Detection rate: 0 on 6 (0%)
Status: CLEAN
Detections
AVG -
Avira AntiVir -
ClamAV -
Emsisoft -
TrendMicro -
Zoner -
Scan report generated by
NoVirusThanks.org
I had 1 detection after crypting for some reason. So i followed your method. And this is what i got.
Quote:File Info
Report date: 2011-05-19 02:04:41 (GMT 1)
File name: brycii-exe
File size: 1611264 bytes
MD5 Hash: cb9536a1c5214532a31d41da85561cb9
SHA1 Hash: 169faf748662afe70e7809494f0fb93348a99906
Detection rate: 1 on 6 (17%)
Status: INFECTED
Detections
AVG -
Avira AntiVir - TR/ATRAPS.Gen
ClamAV -
Emsisoft -
TrendMicro -
Zoner -
Scan report generated by
NoVirusThanks.org
I Dont get it. Unless that's it. I've been dealing with 1/6 detections but it gets annoying.
* - xSkid - May 18, 2011
(May 18, 2011 05:13 PM)Rukkas Wrote: So. Here is what i did. I used a stub that was completely FUD.
I had 1 detection after crypting for some reason. So i followed your method. And this is what i got.
I Dont get it. Unless that's it. I've been dealing with 1/6 detections but it gets annoying.
Hey mate!
To get rid of Avira, your stub needs a bigger sized icon
[350KB - 500KB HD ICON] and it will remove the Avira. ;)
Hope that helped, also consider adding some junk code to the
stub.
* - Rukkas - May 18, 2011
(May 18, 2011 05:17 PM)xSkid Wrote: Hey mate!
To get rid of Avira, your stub needs a bigger sized icon
[350KB - 500KB HD ICON] and it will remove the Avira. ;)
Hope that helped, also consider adding some junk code to the
stub.
I Will definitely try this. Ill post back in a few minutes. Again with before and after effects.
* - xSkid - May 18, 2011
(May 18, 2011 05:21 PM)Rukkas Wrote: I Will definitely try this. Ill post back in a few minutes. Again with before and after effects.
Alright ;)
Also if you need a junk-code generator,
On my first Post, there is a tool called "Assembly Changer" , download that & it will have a junk-code generator. ;)
Also, the basic stuff..
1) Try to change some strings on your Stub.
[I have another thread on this...]
[Strings Normally Start with DIM Crypt As etc...]
2) Change the Icon to a HD Icon
3) Use a cracked tool to Obfuscate the program.
* - Rukkas - May 18, 2011
I cant find any Icons that are bigger then 93kb. My stub is fine. Ive scanned it. it doesn't get detected. When i crypt my server, is when the detection arises. I'm still looking for icons to use, and see if it bypasses avira.
* - xSkid - May 18, 2011
(May 18, 2011 05:33 PM)Rukkas Wrote: I cant find any Icons that are bigger then 93kb. My stub is fine. Ive scanned it. it doesn't get detected. When i crypt my server, is when the detection arises. I'm still looking for icons to use, and see if it bypasses avira.
Ok, lol. i will need to write-up a smaller Tutorial right here on the stop for you.. so let me start.. ;)
NOTE: Please get a fresh stub, that has not been obfuscated or anything, no extra-additions, no assembly change, nothing a clean stub that is detected, we are going to be RE-FUDING it.
And yes.. i just made this for you.. right now...
Step 1
1) Download The Following
http://www.mediafire.com/?6jqqzronzgw55oa
2) Extract the Program and start it, when the program
starts you will see 3 tabs on the top, select "Assembly Changer",
You are now into a new form.
3) Now on the top click "open" and select your Stub that is
NOT FuD.
4) Put "Hijack This 2007" into ALL of the forms/textbox's, when
you get down to "product version" tap on the Yellow Thing next
to the Textbox a few times, do the same for the next one,
"file version"
5) Now Download THIS icon, and select the "open" at the last
textbox.
SIZE ICON: 361KB
DOWNLOAD: http://www.mediafire.com/?3jk883synuxdzdl
6) Find where you saved the Icon, and select it.
7) Click "Save Info"
DONE..
Step 2
1) Download This Cracked Tool.
DOWNLOAD: http://www.mediafire.com/?ixcnvod586dxt6s
2) Open the tool, in the top tab, select "Application"
3) Click "Add"
4) And select your Stub that we have just added a icon too and
changed the assembly.
5) In the Dropbox Below, where it says "Preset" , select "Null" , PLEASE DO NOT SELECT ANYTHING ELSE.
6) Then Click "Xenocode Application".
Done. ;)
Enjoy...
* - Rukkas - May 18, 2011
Okay so I've followed everything completely. Tried it numerous times, with different files. still getting this output.
Quote:File Info
Report date: 2011-05-19 03:34:11 (GMT 1)
File name: crypted-exe
File size: 1596416 bytes
MD5 Hash: d2c0e58420c7cc0178caa028f9a7f689
SHA1 Hash: 1f3ffb3eae19a123e96eeb7ae0d737dccb134187
Detection rate: 1 on 6 (17%)
Status: INFECTED
Detections
AVG -
Avira AntiVir - TR/ATRAPS.Gen
ClamAV -
Emsisoft -
TrendMicro -
Zoner -
Scan report generated by
NoVirusThanks.org
Even with using your icon. I'm not understanding. Haha. Well ill just live with 1/6 i guess.
Still comes up detected. 1/6 by Avira. Even if i use your icon, and follow all the steps. I don't know. I'll just live with 1/6 detected. =) thanks for all your help.
* - sunny98 - May 18, 2011
Awesome tutorial for beginners here on hackforums.
I am not a beginner i know a lot but this will help many new members ! :)
* - xSkid - May 18, 2011
Thanks for the comments guys ;) thank you so much!
;)
* - Eredivisie - May 18, 2011
My file goes from 40/43 to 39/43 THANKS MAN...
* - smit - May 18, 2011
Really nice tut
Thanx for sharing :)
* - xSkid - May 18, 2011
No problem ;)
We've hit 1.1k views ;)
Thanks guys!