+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Hacking Tools and Programs (https://hackforums.net/forumdisplay.php?fid=10)
+---- Thread: My Crypter + Binder (Still Beta Need Help with Hexing Stubs) (/showthread.php?tid=160784)
My Crypter + Binder (Still Beta Need Help with Hexing Stubs) - xSilent - Oct 7, 2009
Ok, with tutorials I made this crypter and binder in vb6. Now they are detected, but I tried to Hex it and I always screw up. If someone could help me that would be awesome. Well here they are
And I suck at GUI so I don't want to hear how bad it looks
If any of you want to help me then please add me
My yahoo messenger: killerxcrypter
Crypter:
[img]http://i416.photobucket.com/albums/pp241/4thkyutest/pic1.jpg[/img]
Binder:
[img]http://i416.photobucket.com/albums/pp241/4thkyutest/pic2.jpg[/img]
Virus Scans:
Note bstub is for the binder and Stub is for the crypter
File Info
Report generated: 8.10.2009 at 5.34.39 (GMT 1)
Filename: bstub.exe
File size: 20 KB
MD5 Hash: Removed
SHA1 Hash: Removed
Self-Extract Archive: Yes => RarSFX Archive
Binder Detector: Nothing found
Detection rate: 5 on 23
Detections
a-squared - Trojan-Dropper.Win32.VB!IK
Avira AntiVir - -
Avast - -
AVG - -
BitDefender - -
ClamAV - -
Comodo - -
Dr.Web - -
Ewido - -
F-PROT6 - -
Ikarus T3 - Trojan-Dropper.Win32.VB
Kaspersky - HEUR:Trojan.Win32.Generic
McAfee - Generic VB.i trojan
NOD32 v3 - -
Norman - New unknown virus W32/Obfuscated.BQ!genr
Panda - -
QuickHeal - -
Solo Antivirus - -
Sophos - -
TrendMicro - -
VBA32 - -
VirusBuster - -
ZonerAntivirus - -
Scan report generated by
NoVirusThanks.org
Crypter Stub:
File Info
Report generated: 8.10.2009 at 5.34.39 (GMT 1)
Filename: Stub.exe
File size: 16 KB
MD5 Hash: Removed
SHA1 Hash: Removed
Self-Extract Archive: Nothing found
Binder Detector: Nothing found
Detection rate: 9 on 23
Detections
a-squared - Trojan.Inject!IK
Avira AntiVir - TR/Dropper.Gen
Avast - -
AVG - Dropper.Heliosb.N
BitDefender - Trojan.Dropper.VB.1
ClamAV - -
Comodo - -
Dr.Web - Trojan.PWS.Multi.76
Ewido - -
F-PROT6 - -
Ikarus T3 - Trojan.Inject
Kaspersky - -
McAfee - Generic VB.i trojan
NOD32 v3 - Win32/Injector.WZ
Norman - -
Panda - -
QuickHeal - -
Solo Antivirus - -
Sophos - -
TrendMicro - -
VBA32 - Trojan.VB.Motil
VirusBuster - -
ZonerAntivirus - -
Scan report generated by
NoVirusThanks.org
Client:
File Info
Report generated: 8.10.2009 at 6.54.39 (GMT 1)
Filename: Client.exe
File size: 52 KB
MD5 Hash: Removed
SHA1 Hash: Removed
Self-Extract Archive: Yes => RarSFX Archive
Binder Detector: Nothing found
Detection rate: 0 on 23
Detections
a-squared - -
Avira AntiVir - -
Avast - -
AVG - -
BitDefender - -
ClamAV - -
Comodo - -
Dr.Web - -
Ewido - -
F-PROT6 - -
Ikarus T3 - -
Kaspersky - -
McAfee - -
NOD32 v3 - -
Norman - -
Panda - -
QuickHeal - -
Solo Antivirus - -
Sophos - -
TrendMicro - -
VBA32 - -
VirusBuster - -
ZonerAntivirus - -
Scan report generated by
NoVirusThanks.org
Download Link Here
If anyone can help me Hex the stubs, it would be awesome
I hope you guys like it 👍
Binder:
Shapes = Add
Truck = Remove
Drill = Bind
Crypter:
Binoculars = Find
Safe = Crypt
* - Gizmo - Oct 8, 2009
I'm going to test this.
<short>>>>>>>>>>>>>>>>>>>>
Crypter is not fud anymore :p And as second, I can't find the binder.
File Info
Report generated: 8.10.2009 at 16.40.44 (GMT 1)
Filename: crypterll.exe
File size: 25 KB
MD5 Hash: db7a3fe0724fd475f7b21f6f428abcba
SHA1 Hash: BB497BC9B90A94DC39ADA0093509895054148575
Self-Extract Archive: Nothing found
Binder Detector: Nothing found
Detection rate: 11 on 23
Detections
a-squared - Trojan.Inject!IK
Avira AntiVir - TR/Crypt.XDR.Gen
Avast - Win32:VB-LTZ [Trj]
AVG - Dropper.Heliosb.N
BitDefender - Trojan.Dropper.VB.1
ClamAV - -
Comodo - -
Dr.Web - Trojan.PWS.Multi.76
Ewido - -
F-PROT6 - -
Ikarus T3 - Trojan.Inject
Kaspersky - -
McAfee - Generic VB.i trojan
NOD32 v3 - Win32/Injector.WZ
Norman - -
Panda - -
QuickHeal - -
Solo Antivirus - -
Sophos - Mal/VB-AB
TrendMicro - -
VBA32 - Trojan.VB.Motil
VirusBuster - -
ZonerAntivirus - -
Scan report generated by
NoVirusThanks.org
* - xSilent - Oct 8, 2009
(Oct 8, 2009 07:32 AM)Gizmo Wrote: I'm going to test this.
<short>>>>>>>>>>>>>>>>>>>>
Crypter is not fud anymore :p And as second, I can't find the binder.
File Info
Report generated: 8.10.2009 at 16.40.44 (GMT 1)
Filename: crypterll.exe
File size: 25 KB
MD5 Hash: db7a3fe0724fd475f7b21f6f428abcba
SHA1 Hash: BB497BC9B90A94DC39ADA0093509895054148575
Self-Extract Archive: Nothing found
Binder Detector: Nothing found
Detection rate: 11 on 23
Detections
a-squared - Trojan.Inject!IK
Avira AntiVir - TR/Crypt.XDR.Gen
Avast - Win32:VB-LTZ [Trj]
AVG - Dropper.Heliosb.N
BitDefender - Trojan.Dropper.VB.1
ClamAV - -
Comodo - -
Dr.Web - Trojan.PWS.Multi.76
Ewido - -
F-PROT6 - -
Ikarus T3 - Trojan.Inject
Kaspersky - -
McAfee - Generic VB.i trojan
NOD32 v3 - Win32/Injector.WZ
Norman - -
Panda - -
QuickHeal - -
Solo Antivirus - -
Sophos - Mal/VB-AB
TrendMicro - -
VBA32 - Trojan.VB.Motil
VirusBuster - -
ZonerAntivirus - -
Scan report generated by
NoVirusThanks.org
I know its not FUD, thats why I need help Hexing the Stubs..I always screw up lol and go to File and Binder
* - carnagez71 - Oct 8, 2009
could u fud my metus bot for free
* - Gizmo - Oct 8, 2009
(Oct 8, 2009 08:04 AM)carnagez71 Wrote: could u fud my metus bot for free
Dude, why SPAM here? Read the thread first before posting anything dude.
* - xSilent - Oct 8, 2009
(Oct 8, 2009 08:31 AM)Gizmo Wrote:(Oct 8, 2009 08:04 AM)carnagez71 Wrote: could u fud my metus bot for free
Dude, why SPAM here? Read the thread first before posting anything dude.
carnage failed lol
* - xSilent - Oct 8, 2009
Any help with hexing?
* - Frag_Bag - Oct 9, 2009
Sorry dont know hexing, did you try a video tutorial?
* - xSilent - Oct 9, 2009
Most of the video tuts, dont deal with crypter stubs, thats why I need help
* - Ryxa - Oct 9, 2009
What method are you using to hex edit the stub?
* - xSilent - Oct 10, 2009
(Oct 9, 2009 10:29 PM)HaruhiSuzumiya Wrote: What method are you using to hex edit the stub?
uh, ok the video tutorial he was filling most of the stub with 00 and I tried doing that, but I screwed up my stub
and I dont understand file splitting
I'm using the HxD hex editor
* - Ryxa - Oct 10, 2009
Well, I don't know about filling it in with zero's, but you're suppose to split the file, and scan then split the infected part, then scan, and so on, until you find the hex that's tagged by the antivirus. It should be something like "52". Just overwrite the 2 numbers with 2 zeros.
* - xSilent - Oct 10, 2009
(Oct 10, 2009 10:09 AM)HaruhiSuzumiya Wrote: Well, I don't know about filling it in with zero's, but you're suppose to split the file, and scan then split the infected part, then scan, and so on, until you find the hex that's tagged by the antivirus. It should be something like "52". Just overwrite the 2 numbers with 2 zeros.
My AV sucks at just scanning files, but what AV do you suggest?
* - Ryxa - Oct 10, 2009
(Oct 10, 2009 01:12 PM)xKillerxPanther Wrote:(Oct 10, 2009 10:09 AM)HaruhiSuzumiya Wrote: Well, I don't know about filling it in with zero's, but you're suppose to split the file, and scan then split the infected part, then scan, and so on, until you find the hex that's tagged by the antivirus. It should be something like "52". Just overwrite the 2 numbers with 2 zeros.
My AV sucks at just scanning files, but what AV do you suggest?
Use MultiAV scanner when hexediting.
* - xSilent - Oct 10, 2009
(Oct 10, 2009 01:12 PM)HaruhiSuzumiya Wrote:(Oct 10, 2009 01:12 PM)xKillerxPanther Wrote:(Oct 10, 2009 10:09 AM)HaruhiSuzumiya Wrote: Well, I don't know about filling it in with zero's, but you're suppose to split the file, and scan then split the infected part, then scan, and so on, until you find the hex that's tagged by the antivirus. It should be something like "52". Just overwrite the 2 numbers with 2 zeros.
My AV sucks at just scanning files, but what AV do you suggest?
Use MultiAV scanner when hexediting.
Do you have a link for a one that works? the one I have cant open files
If you do, thanks