+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Keyloggers (https://hackforums.net/forumdisplay.php?fid=113)
+---- Thread: Then how can i know it's not binded or backdoored (/showthread.php?tid=2717304)
Then how can i know it's not binded or backdoored - reyo47 - Jul 26, 2012
hey HF members
So i hope you all fine
my question is : how do i know if a file isn't binded or backdoored and sandbox can be bypassed by some crypters !!! 😧
i thought if sandbox didn't show any suspicious app then it's not infected but it did and i had to remove it with DC remover
So what's the solution ?
Thanks for reading 🤝
So i hope you all fine
my question is : how do i know if a file isn't binded or backdoored and sandbox can be bypassed by some crypters !!! 😧
i thought if sandbox didn't show any suspicious app then it's not infected but it did and i had to remove it with DC remover
So what's the solution ?
Thanks for reading 🤝
* - Nordic - Jul 27, 2012
One simple way of checking it is to "Open Archive" with 7zip, then you can see what's inside.
When you do that with legit files the message you get is that you can not open it, if the file is binded/backdoored you will see what's inside.
You can also check it with hex editors, I think there are some tutorials on here on how to do it.
I know you can get the creator of the virus' email and password if that's what they are using.. But that's another story.
Good luck!
* - xtraesp - Jul 27, 2012
(Jul 27, 2012 12:13 PM)j0113 Wrote: One simple way of checking it is to "Open Archive" with 7zip, then you can see what's inside.
When you do that with legit files the message you get is that you can not open it, if the file is binded/backdoored you will see what's inside.
You can also check it with hex editors, I think there are some tutorials on here on how to do it.
I know you can get the creator of the virus' email and password if that's what they are using.. But that's another story.
Good luck!
Right, I just tried the 7-zip thing with a binded file of mine.
Didn't work.
@OP sandboxie should show more than one exe if it is binded.
Check for file drops with sandboxie.
* - Nordic - Jul 27, 2012
(Jul 27, 2012 12:18 PM)Myers Wrote: Right, I just tried the 7-zip thing with a binded file of mine.
Didn't work.
@OP sandboxie should show more than one exe if it is binded.
Check for file drops with sandboxie.
Hmm, well I am sure that I have seen some way to check it with 7-zip.
But my memory from where or how is blurry.
Maybe it depends on how well coded the binder is.
* - A + - Jul 28, 2012
(Jul 27, 2012 12:18 PM)Myers Wrote: Right, I just tried the 7-zip thing with a binded file of mine.
Didn't work.
@OP sandboxie should show more than one exe if it is binded.
Check for file drops with sandboxie.
What he said.
Also, if you learn how to read Anubis scans, you can figure it our from there.
http://anubis.iseclab.org/
* - reyo47 - Jul 28, 2012
(Jul 28, 2012 06:09 PM)TheCause Wrote: What he said.
Also, if you learn how to read Anubis scans, you can figure it our from there.
http://anubis.iseclab.org/
is there any tut about it ??
or u may explain it to me :)) 😊🙂