+- Hack Forums (https://hackforums.net)
+-- Forum: Marketplace (https://hackforums.net/forumdisplay.php?fid=105)
+--- Forum: Bazaar (https://hackforums.net/forumdisplay.php?fid=450)
+---- Forum: Marketplace Discussions (https://hackforums.net/forumdisplay.php?fid=163)
+---- Thread: Trick to make a Runtime Crypter work without a RunPe (/showthread.php?tid=1157892)
Trick to make a Runtime Crypter work without a RunPe - pr0t0typ3 - Mar 25, 2011
Hey guys,
Basically I found a "exploit" which does allow something cool and I want your opinion:
- You have a Scantime Cryter which does drop the crypted malware.
- This Crypter does write one Registry Key before dropping the file.
- The Scantime Crypter does drop the file and execute it.
- No Anti-Virus Guard will pick it up until the victim does directly scan the file because of the Registry Key.
I tested it on Avira Anti-Vir and Kaspersky and I'm currently checking if it does work with the heuristic engines of the AVs, but yeah what do you think. Should I sell it ? It would make all RunPEs unnecessary.
* - hxkd - Mar 25, 2011
A trick like that would not last very long, and you just more or less told us how to do it (well, I guess we would need the location) but hell yeah, don't share stuff, sell it, too many leechers.
hxkd
* - pr0t0typ3 - Mar 25, 2011
(Mar 25, 2011 10:44 AM)hxkd Wrote: A trick like that would not last very long, and you just more or less told us how to do it (well, I guess we would need the location) but hell yeah, don't share stuff, sell it, too many leechers.The Registry is big and you would need the location to make it work but yeah I don't think I'll share it
hxkd
* - hxkd - Mar 25, 2011
How on Earth did you find this though? :O
hxkd
(Mar 25, 2011 10:55 AM)pr0t0typ3 Wrote: The Registry is big and you would need the location to make it work but yeah I don't think I'll share it
* - Xenon - Mar 25, 2011
If you sell it, I will buy it in a heartbeat.
* - New Age Griefing - Mar 25, 2011
I definitely reccommend that u sell it
* - DООM! - Mar 25, 2011
Keep it for yourself and sell a crypter here, but keep sales limited.
* - KillαMuvz - Apr 16, 2011
Packers? :3 IF it is what I think you'll understand what I just said <3
* - Supreme Kai - Apr 16, 2011
Sell it you will get alot of customers.
* - narutorine - Apr 16, 2011
sell it but limited customers that's my opinion nice work :)
* - wacked3 - Apr 16, 2011
(Mar 25, 2011 10:43 AM)pr0t0typ3 Wrote: Hey guys,This trick isn't new and will not work! Avirar for example checks all files and immadently ditches files that don't start with "MZ" (marking a Portable Executable)
Basically I found a "exploit" which does allow something cool and I want your opinion:
- You have a Scantime Cryter which does drop the crypted malware.
- This Crypter does write one Registry Key before dropping the file.
- The Scantime Crypter does drop the file and execute it.
- No Anti-Virus Guard will pick it up until the slave does directly scan the file because of the Registry Key.
I tested it on Avira Anti-Vir and Kaspersky and I'm currently checking if it does work with the heuristic engines of the AVs, but yeah what do you think. Should I sell it ? It would make all RunPEs unnecessary.
Also it will make no effect to any AV with behaviour blocking (which could be considered a form of heuristics)
The registry key (HKEY_CLASSES_ROOT\) has been known for years.
* - Mater™ - Apr 17, 2011
Loll ! i need a crypter for 64bit i give 50$ :O [email protected]
* - Taserz - Apr 17, 2011
once one av see a reg write it will then associate it as malware.
* - pr0t0typ3 - Apr 17, 2011
(Apr 17, 2011 06:21 PM)Taserz Wrote: once one av see a reg write it will then associate it as malware.
Uhm no ?! 90 % of all applications do write to the registry which does not mean they are maleware -.-