Hack Forums
Absolute Crypter Review - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Cryptography, Encryption, and Decryption (https://hackforums.net/forumdisplay.php?fid=126)
+---- Thread: Absolute Crypter Review (/showthread.php?tid=4936981)

Pages: Pages 1 2 3

Absolute Crypter Review - FastCrypt - Aug 5, 2015

Sales thread: https://hackforums.net/showthread.php?tid=4616066

Ok here is my review.
I was instructed not to leave any negative feedback or i would lose my license as soon as i bought this crypter.
I thought to myself that there must be a reason why he writes this as his first statement to me after i purchased it.
However I'm still going to give my honest opinion on this. I bought this, it took about two days before i actually got the program but okay i can live with that.

[Image: 090bb2df18e213103503f575e1e3c8bf.png]

[Image: 7424d289f1261a078d711a7066aafb8c.png]

First, i thought he wrote in his thread that it was coded in C++ ?
[Image: 546af93afb65fd9f4626a144dd2ecd0b.png]

It's not?
[Image: 7fbd919b7b741faeea6529725245422d.png]

Stub size is about 408kb, stuffed with junk, clearly the one who wrote this does not know how to code a proper crypter.
After receiving it i was curious because he advertises that it "bypasses ALL" antivirus runtime so i put it to the test in my boxed environment.

Testing performed with ESET
[Image: 5717c2f7cd258bc46e8c5cc5778b7ab9.gif]

Testing performed with Norton
[Image: ffcad852bd4c74198883baed0d3a0415.gif]

Testing performed with Kaspersky
[Image: 0351ba8c63ef7c7e8d805584a97a986f.gif]

[Image: c070bb058b336ee351354b07ec774862.gif]

Testing performed with Bitdefender
[Image: 33ab1199586642689d3743cfbcdb6ecf.gif]

A little cute loop that counts nothing, after this a few more useless loops followed along with sleep etc... i bet this is effective against runtime antivirus(ironic).....
[Image: 9994c6fa3cca19ff62b31f3e30635530.png]

EDIT - A few hours after i wrote this thread, the files became heavily detected obviously because the lack of runtime, even though he made it "undetected" ~14 hours ago.
[Image: 84d192a67ad1293d327798cc8c500c0e.png]

14 hours later....
[Image: a69d02205b2ef93e0d4b2c2e704e3b39.png]

I was planning on doing further analysis in ollydbg, but as it didnt succeed on even one of my tests i assume this was not even necessary.
But what I can say so far, poorly coded crypter with little to none protection against both AV and reversers.

When a crypter like this is not runtime against any of the major AV's they will all distribute the samples caught, and share them between eachother.
No wonder this crypter is fud for just a few hours.

You can gangrep me all you want, i dont care. I just feel that people should know this before they buy.
False advertising is not the way to go as a scantime only crypter can be coded FUD in C++ in less than a day.

* - Maxi - Aug 5, 2015

Glad to see that there are some good members here. Thanks.

* - Wardow - Aug 5, 2015

Edit, seem like real, omg.

* - Raymond Reddington - Aug 5, 2015

Wow, that's why you go with some crypter from a quality coder.

* - FastCrypt - Aug 5, 2015

(Aug 5, 2015 11:01 AM)W̴̵̶̷̸̸̷̶̵̴̨̧̧̨̛̛̠̲͇αя∂σω Wrote:  These are either error messages because you run the file in a Virtual Machine, he would not sell a crypter like that lol.

No this is memory detection, i have written my own crypter in C++ and its the same problem. Runtime.
This has nothing to do with AntiVM, and for that case anti vm was neither turned on.

* - Wardow - Aug 5, 2015

(Aug 5, 2015 11:18 AM)011010 Wrote:  No this is memory detection, i have written my own crypter in C++ and its the exact same way.
This has nothing to do with AntiVM and for case anti vm was neither turned on.

then explain me why the error message does not follow the standard?

* - FastCrypt - Aug 5, 2015

(Aug 5, 2015 11:18 AM)W̴̵̶̷̸̸̷̶̵̴̨̧̧̨̛̛̠̲͇αя∂σω Wrote:  then explain me why the error message does not follow the standard?

It hits ResumeThread, then AV message pops up in right corner then disables the execution.
If i encrypt a messagebox or putty.exe for that instance the execution will be successfull because its not detected by their memory scanner. But as soon as you encrypt malware with it, you will get what i just showed you.

If you want me to show you my own self written crypter in a demonstration against the same issue, i will do it with pleasure, contact me in PM.

* - kneegurs - Aug 5, 2015

good nice to see some people not bsing for once.

* - Hash G. - Aug 5, 2015

I'd call this an honest review, thanks for the heads up OP.

* - Bull™ - Aug 5, 2015

Marvid is an artistic scammer Thats all I want to say .

* - 'An0ny - Aug 5, 2015

You've done some excellent research here my friend, thanks for sharing the truth about the Crypter.

* - FastCrypt - Aug 5, 2015

Added a bit more to the thread.

* - OneHundred14 - Aug 6, 2015

I'm glad to see a honest review. The crypter section need more honest review and less fake vouchs. Also, i must say that 7/35 are not the real detections, kazy and vary detections are for assembly and icon. Its only detected by avira and kaspersky.

Before to buy any Crypter, first read all his sales thread to avoid be scammed by fake vouch done by idiots. There is any crypter in all HF that can bypass 100% of AV. If you found it, just pm because i want test it on my VM with every AV on runtime with all heuteristic enabled.

* - BLiNDzZ - Aug 6, 2015

lol so glad someone finally wrote a review. i knew this months ago but i was too lazy to say my claims and provide proof good post glad this idiot is getting exposed.

* - Meow - Aug 6, 2015

Thanks a lot for this review!