+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+----- Forum: Hacking Tutorials (https://hackforums.net/forumdisplay.php?fid=47)
+----- Thread: [TuT] Make virus undetectable by HEXeditor[TuT] (/showthread.php?tid=177983)
[TuT] Make virus undetectable by HEXeditor[TuT] - Arês™ - Nov 5, 2009
Many people asking how to hexedit, I decided to write
this little tutorial. I will try to explain how to hexedit your favourite Trojan in order to
make it undetected by certain antivirus programs. I will try to put this as simple as
possible so everyone understands it.
Content:
1. General info about hexediting .
2. What tools you need to get started.
3. How to hex.
-step 1
-step 2
-step 3
1. General info about hexediting?
If you want to make your server undetectable, you need to know how AVs work and
how they detect your files, right? There are a few ways that AVs use to detect your
server heuristics, sandboxing, etc., and one of them is using so called "definition files"
that carry information about strings inside your server. Well, that's the way we are
going again in this tutorial because hexing is pretty much useless for other methods of
detection. So when AVs scan your files it searches for specific stings on specific parts
in your server, and if strings match with strings in the AV database, your file is
detected.
Let as say that detected strings are "XX" so we need to change that string to something
else (e.g. "XY","YY") that isn't in the AV definition database so the file can not be
matched with any of the AV definitions and that way the file will be undetectable.
There are going to be a few tagged strings in your server - not only one, depending on
what trojan you are using and how popular is. Less popular trojans tend to have less
tagged parts, and with that they are easier to make it undetectable.
First of all, hexing is not the best method for undetecting files because AVs can
change old tagged parts, and once your AV is updated, new definition files are
downloaded and your once undetected server might become detected again. Also not
all AVs use the same tagged parts - this way you need to hex your server against more
AVs to make it fully undetected. This can be annoying because you need to download
wanted AVs then hex it your server, then download another etc., etc. Sometimes AVs
tag critical parts of the server, and if that part is altered will corrupt the server. Also,
heavily edited servers can become unstable, some functions might not work, or even
you can corrupt your server and make it useless.
Thats why you need to check your server if its still working after every single
change you made while hexing it.
Now how to find detected strings in your server?
There are few ways you can do this: Manually cut your server in half adding parts to
one half and scanning it until you find the detected string (which is slow and time
consuming); use file splitters to split your server into
bytes, and after that scan all split files and find out what byte is detected then alter it
in original exe, or you can use an offset AV .
2. What tools we need.
- Unpacked trojan server. (That's your virus)
- Hex editor > DOWNLOAD
- File Splitter > DOWNLOAD
- AV-antivirus
3. How to hex:
Now to help you simplify the method I put this video clip TuT how can u make virus undetectable by AV , Whatch it >
Whatch it here
And please don't be annoying and pessimistic these is my first TuT enjoy😏
* - mister.o - Nov 5, 2009
OK is everything good tut but with that red font my eyes 🤮
* - Freestyll3R - Nov 5, 2009
Thx for sharing very nice tut man ,
* - Arês™ - Nov 5, 2009
(Nov 5, 2009 04:38 AM)mister.o Wrote: OK is everything good tut but with that red font my eyes 🤮
tanx.. i change color a little bit to be more different , cool or some 😉
(Nov 5, 2009 04:39 AM)Freestyll3R Wrote: Thx for sharing very nice tut man ,
No problem 🤝
* - Michael Jackson - Nov 5, 2009
nice i will check it ;)
* - gifar_ucuL - Nov 5, 2009
wowowowow nice tut dude hihihihih thx its cool
* - Arês™ - Nov 5, 2009
(Nov 5, 2009 06:49 AM)gifar_ucuL Wrote: wowowowow nice tut dude hihihihih thx its cool
tanx man....🎉
* - flAmingw0rm - Nov 5, 2009
Great tutorial, but you should posted this in tutorials forums. Good job anyway. :)
* - z1lla - Nov 5, 2009
well,iam having a prob
my stub is detected so splitted it to 10pecies but non of those pecies r detected but when i reassemble it it get deleted by my kasper:(
so i cant like narow it dawn to one peice
* - Arês™ - Nov 5, 2009
you must have option in your AV that can only scan the file but not delete file , i am not using Kasper Av so I don't know but i will post link of multi-AV here, so you can scan your file with 5 or more different AV s ...
* - Badhakz9T - Nov 5, 2009
Nice TUT....i was searching for it...
* - Gizmo - Nov 5, 2009
Thanks for this tutorial :)
* - Arês™ - Nov 5, 2009
tanx for support guys .....
* - MooseHide - Nov 5, 2009
I know this one But nice work with the tut dude
* - Arês™ - Nov 5, 2009
(Nov 5, 2009 07:33 AM)●๋•D4rk357™© . Wrote: I know this one But nice work with the tut dude
I apprishiate that ...