+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Hacking Tools and Programs (https://hackforums.net/forumdisplay.php?fid=10)
+---- Thread: [Tutorial] Fast,free and easy way to check for system infections of FUD malware (/showthread.php?tid=5400626)
[Tutorial] Fast,free and easy way to check for system infections of FUD malware - Fộrcəd - Sep 9, 2016
As you hopefully know, most freshly spread malware are FUD. This makes it hard for Anti-Virus to detect infection. So i'm going to show you how to easily check for COMMON computer infections using freeware and your own brain :)
First of all your gonna need to download Process Explorer
This is one of many great internal tools from Microsoft, its basically a task-manager on steroids, with features such as direct hash checkup towards the VirusTotal database and signature checkup (Best feature)
You wanna run this and admin, it should look something like this.
![[Image: 6c51efd98f3006e7f433d23c29704fe6.png]](https://i.gyazo.com/6c51efd98f3006e7f433d23c29704fe6.png)
This if a screenshot of its running a fresh VM infected by NanoCore.
Now you wanna go to Options>> And Check "Verify image signatures" also go to "VirusTotal.com" and check "Check VirusTotal"
![[Image: d9e22e7d28efc1a64b68769ad36e50cc.png]](https://i.gyazo.com/d9e22e7d28efc1a64b68769ad36e50cc.png)
This will cross check the hash of every running process with the Virus-total database, it will also check if the signature of the file is valid.
^And this is the important part, you can spoof and play with any file all you want, but only an authorized software publisher can assign file's a valid signature. This is basically the easiest way to check any file written to your disk may be possible malware or not.
But keep in mind, this applies only for the written exe/malware on disk, if a malware injects itself into another process, it will not change its valid signature. So this is to locate the physical written malware on disk.
![[Image: acab30cac9f42abccd8dfec03bd2ea77.png]](https://i.gyazo.com/acab30cac9f42abccd8dfec03bd2ea77.png)
As you can see this NanoCore stub has no valid signature and no HF crypter will be able to give it a valid one either. From here we can easily suspend the process , kill the process, locate the file and remove it.
The same applies for persistence, by suspending the process instead of killing it, your break most persistence by Trojans etc.
Microsoft also has another internal tool called "Autoruns", basically shows every startup reg key, so after you kill/suspend the process, you can remove their startup feature
Download: https://technet.microsoft.com/en-us/sysinternals/bb963902
Very good presentation for a more in-depth look, recommend for anyone dealing on HF.
https://www.youtube.com/watch?v=Wuy_Pm3KaV8
My English grammer < shit, PM me.
* - Anxious.exe - Sep 10, 2016
Seems pretty cool, will give it a try soon.
* - yotoprules - Sep 10, 2016
Thanks a lot for this tutorial! I might give this a try if I or someone else ever gets infected
* - jimmyfer - Sep 10, 2016
Great tutorial, this is very usefull. Simple and excelent!
* - Anxious.exe - Sep 11, 2016
Vouch for OP ! Amazing share, amazing tool.
* - Fộrcəd - Sep 11, 2016
(Sep 10, 2016 04:58 AM)Anxious.exe Wrote: Seems pretty cool, will give it a try soon.
(Sep 10, 2016 04:40 PM)yotoprules Wrote: Thanks a lot for this tutorial! I might give this a try if I or someone else ever gets infected
(Sep 10, 2016 06:56 PM)jimmyfer Wrote: Great tutorial, this is very usefull. Simple and excelent!
(Sep 11, 2016 01:08 AM)Anxious.exe Wrote: Vouch for OP ! Amazing share, amazing tool.
Glad you enjoyed
* - Fộrcəd - Sep 26, 2016
I feel this can help allot of users out there, bumping.
* - warpje - Sep 26, 2016
Learned something new nice tutorial! Will check the different RAT and crypter to see how it works with that!
* - Fộrcəd - Sep 26, 2016
(Sep 26, 2016 08:24 AM)warpje Wrote: Learned something new nice tutorial! Will check the different RAT and crypter to see how it works with that!
Please do
It's really interesting to be able to analyze their movement a bit more detailed.
* - Don Genovese - Sep 26, 2016
Very interesting and useful, appreciate the effort gone into it.
* - Sc0rpian - Sep 27, 2016
Great tutorial mate.. ! This would be very helpful for victims whose system got compromised. Also I would prefer to use 'winpatrol' tool which keeps monitor and notify user about all hidden startup programs.
Reference:
winpatrol.com/winpatrol/
* - LanMan - Sep 27, 2016
Nice tutorial, it will help people, and Process Hacker is a nice little tool too.
But these tool will detect only basic malware.
* - [▲■●] - Sep 28, 2016
Thanks for sharing, very useful information.
Ran some checks immediately after reading.
* - iiXenonunim - Sep 28, 2016
Thanks a lot for this tutorial! I highly appreciate it.
* - Tieko - Nov 5, 2016
Thanks a lot for that, it's really useful.
Wherever you are, have a nice day.