+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [C#] [C#] Example Crypter - A crypter example source code (/showthread.php?tid=3622113)
[C#] Example Crypter - A crypter example source code - Delirium™ - Jul 15, 2013
It's been a long time since the last time I've seen a crypter example written in C# that demonstrates various methods. I decided to write an example crypter in C# to help people who like C# get an idea of how crypters work.
Features:
- Native resources storage method
- Managed resources storage method (CodeDom)
- Simple AES encryption
- RunPE Injection (injects to vbc.exe)
- Add file to startup
- Hide file from the file explorer
- Change the stub's icon using CodeDom
- Commented in the most critical parts
Screenshot:
![[Image: GbHBaav.png]](https://i.imgur.com/GbHBaav.png)
Credits:
Oppresor (RunPE)
Odinz (Angelic Wings) (Idea)
PInvoke
Various other people for various reasons.
Source Code:
Example Crypter - GitHub
Addendum:
This source code was written for educational purposes. Do not expect it to be FUD. Some tips might include moving the runpe to an encrypted dll in resources, refactoring the code, replacing methods with alternative ones etc. The source is commented on its most critical parts (compiling, encrypting, structuring the stub). The stub is also commented to help you get an idea. I am not including any password for the file, no PPD, no begs for replies or PMs. This section is a school, not a kiosk where you can bargain for these.
* - Jibbly - Jul 15, 2013
Hey man this looks pretty cool im checking it out now.
* - Snowfox - Jul 15, 2013
I'm looking for this kind of examples bro. Thank you so much.
* - Delirium™ - Jul 15, 2013
I'm glad you found this useful. Thanks for wasting a minute to post.
* - X750434 - Jul 15, 2013
Holy Molly,
1031 downloads.
Are this all Downloads from HF Only.
* - Kōtei - Jul 15, 2013
O.o if that amount of downloads is real and applies to just HF, kind of damn pathetic how many times it's been downloaded with so few thank you's. So, thank you. ^-^
* - Delirium™ - Jul 15, 2013
Yeah, these downloads are from HackForums only. I haven't posted it anywhere else.
It's okay, I just want this thread to be visible on the thread list so people could spare a minute or two to actually read an example crypter source before making a thread about how they can make a crypter.
Edit:
Well, according to the counter on ge.tt, it's getting 1000 downloads on average per minute. I'm glad people liked this.
* - N3oNight - Jul 15, 2013
I Just Check out the source and the code is really clean. You did a grate work.
Just to note out:
- Native storage is Detected by Avira.
- The start-up method is detected by Kis at runtime.
But the managed storage method is still FUD and can be used to make FUD Crypter.
Well done with the example source.
* - Jibbly - Jul 15, 2013
Wtf 7k download wtf Hackforums post and stop being a leech.
i mean damn i would rage lol.
* - Kōtei - Jul 15, 2013
I think Gett's download counter is broken. O.o There's no way it's getting THAT many downloads when only registered members can see this thread. :L
* - Jibbly - Jul 15, 2013
(Jul 15, 2013 08:53 AM)Umbrein Wrote: I think Gett's download counter is broken. O.o There's no way it's getting THAT many downloads when only registered members can see this thread. :L
Wildfire nuff said lol but really people need to say thanks.
* - Delirium™ - Jul 15, 2013
(Jul 15, 2013 08:49 AM)N3oNight Wrote: I Just Check out the source and the code is really clean. You did a grate work.
Just to note out:
- Native storage is Detected by Avira.
- The start-up method is detected by Kis at runtime.
But the managed storage method is still FUD and can be used to make FUD Crypter.
Well done with the example source.
I know about the two facts you posted. However, the native storage method can be FUDed with some tweaks. I won't post any details here as I believe I'll be spoonfeeding. The point was not to provide a FUD source anyway, it was just to demonstrate how a crypter works. I've written a C# example because I hardly found any modern one.
As for KIS, it can be bypassed by using techniques to exhaust the emulation of proactives. I'm pretty sure you know all these though as you're an experienced programmer. Just outlined them so other people can read it.
(Jul 15, 2013 08:53 AM)Umbrein Wrote: I think Gett's download counter is broken. O.o There's no way it's getting THAT many downloads when only registered members can see this thread. :L
Well, maybe it went bananas. No idea :P - That's what it says, that's what I said.
* - x64 - Jul 15, 2013
What's the point of adding this:" [C#] " to the thread title? We are in the C# section, every project is C# here.
* - Delirium™ - Jul 15, 2013
(Jul 15, 2013 09:18 AM)Lambik Wrote: What's the point of adding this:" [C#] " to the thread title? We are in the C# section, every project is C# here.
Beauty, eye candy and because I felt like doing so. Does that have anything to do with the point of the thread anyway?
* - Kōtei - Jul 15, 2013
(Jul 15, 2013 09:18 AM)Lambik Wrote: What's the point of adding this:" [C#] " to the thread title? We are in the C# section, every project is C# here.
Because when viewing the forum index you can't see if it's in the VB or C# section.