+- Hack Forums (https://hackforums.net)
+-- Forum: Marketplace (https://hackforums.net/forumdisplay.php?fid=105)
+--- Forum: Bazaar (https://hackforums.net/forumdisplay.php?fid=450)
+---- Forum: Marketplace Discussions (https://hackforums.net/forumdisplay.php?fid=163)
+---- Thread: Announcing polymorphic crypter - snowflake (/showthread.php?tid=2764995)
Announcing polymorphic crypter - snowflake - cinik - Aug 10, 2012
I'd like to announce a new polymorphic crypter that will be
available in a few weeks to trusted people here.
This poly engine is a result of hard work that's been done over last few months of researching and programming.
I want to state that this isn't just a polymorphic crypter, it's a basically crypter that uses my poly engine for generating decryptors which appear differently every time.
Poly engine, itself, can be used in any other project such as worms, viruses, shellcodes, whatever, it's totally PIC (position independent code).
It uses different crypting functions with random key every time, and it's bidirectional (decrypts file in two directions).
It's coded in C, can be compiled with any C compiler (msvc, borland cpp,
pelles C, mingw). And yes, it's x86 poly also.
It doesn't use runPE methods, or any injection, so it will work with files that have .reloc section (msvc compiled files are best).
Any suggestions, advices, questions are welcome.
ICQ: 634937859
MSN: [email protected]
Skype: vx.cinik
* - Lil Shiot - Aug 10, 2012
Quote:It doesn't use runPE methods, or any injection, so it will work with files that have .reloc section (msvc compiled files are best).
So...How do you bypass security software on runtime? Got a priv8 method?
* - ¤ Nick™ ¤ - Aug 10, 2012
Vouch for the OP on this one. I'm so proud. 😭
* - Pineapple - Aug 10, 2012
Why do I have a feeling this will fail?
* - cinik - Aug 10, 2012
(Aug 10, 2012 11:10 AM)¤ Nick™ ¤ Wrote: Vouch for the OP on this one. I'm so proud. 😭
Thank you babe. I told ya I was gonna make it :P.
* - prodigyhf - Aug 10, 2012
(Aug 10, 2012 11:11 AM)Pineapple Wrote: Why do I have a feeling this will fail?
Because this is HackForums, the land of attention-whores and skids.
* - cinik - Aug 10, 2012
(Aug 10, 2012 11:11 AM)Pineapple Wrote: Why do I have a feeling this will fail?
And why would it fail. According to my last few tests, it's working very well. The crypted files are not recognised by any AV so far.
I am planning to add other things as well but at this very moment
I don't have to do anything because it's FUD already.
* - iamtheq - Aug 10, 2012
It does work by re-basing the original PE?
* - cinik - Aug 10, 2012
Well, I've seen crypters injecting into other files, etc. I want to make a distinction, my crypter won't do any injecting/spreading, relocable files will be loaded on heap with fixed imports, resources, whatever and run there.
As simple as that.
* - Pinch - Aug 10, 2012
wat i tought polymorphic crypt onli possible to make in .net???
u cheatin
* - iamtheq - Aug 10, 2012
For once there is something interesting on this forum and what does the author get from it: flame party. Great! -.-
* - RemBlack - Aug 10, 2012
(Aug 10, 2012 11:40 AM)cinik Wrote: Well, I've seen crypters injecting into other files, etc. I want to make a distinction, my crypter won't do any injecting/spreading, relocable files will be loaded on heap with fixed imports, resources, whatever and run there.Nice. Shouldn't add bunch of garbage like rest of the cryptors here.
As simple as that.
Don't add spreaders and all that crap.
Should add antis though. Self coded working ones. 👍
* - janceym - Aug 12, 2012
(Aug 10, 2012 11:09 AM)Lil Shiot Wrote: So...How do you bypass security software on runtime? Got a priv8 method?
RunPE is more suspicious than not injecting
* - Touch Me Maybe - Aug 12, 2012
(Aug 12, 2012 05:15 AM)janceym Wrote: RunPE is more suspicious than not injecting
If you're talking about injecting another process then no, unless you've got a good method injecting is way more detected.