+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Remote Administration Tools (https://hackforums.net/forumdisplay.php?fid=114)
+---- Thread: Misconceptions about dependencies (/showthread.php?tid=5467540)
Misconceptions about dependencies - Slavoj Žižek - Nov 18, 2016
There is a lot of incorrect information going around hf, I want to slightly change that
What is a dependency?
A dependency for example java or .net that needs to be installed for the file to execute. if you have a no dependencies file it will more than likely have a quite high execution rate.
C++ is non-dependant right?
No, not necessarily sometimes some C++ files use Visual C++ which need the visual C++ framework installed. but most of the time C++ will be native.
I was told .net was running on 98% of computers?
I'm not sure about the 98% number but yes there is a quite high percentage of computers that have .net pre-installed
One problem .net is not fully reverse compatible, for example if I have .net 2.0 malware it will only execute (without installing extra updates) on windows 7 machines
leaving 8, 8.1, 10, vista and XP out of the picture whereas if I had .net 4.0 malware it will execute on windows 10 (without installing extra updates) but nothing else
(some frameworks come packaged with other ones, for example the .net 2.0 installer also installs 3.5)
when it comes to windows XP its best to have non-dependant malware since its pre-installed with no .net frameworks.
so just because 98% of computers have .net installed does not mean you will have a 98% execution rate, there are many variables
If I crypt a .net file with A native crypter that makes it native right?
You would seriously be surprised with the amount of people that actually think this but it is completely incorrect
a .net file will always be .net there is nothing you can do about that and if you crypt a .net file with a native crypter the execution rate will be held back because they still need the
correct .net framework installed for the file to work.
crypting native malware with a .net crypter is a pretty bad Idea, since your malware is native you might as well go with a native crypter - get the whole XP - 10 execution range.
What about java then?
java is a cool language and all but nothing comes pre-installed with java (the odd linux distro does) and the only people I have ran into running java were either developers or minecrafters.
Personally I would stay away from java, for execution rate reasons (the actual malware its self might be good)
Ok then, what OS'es come pre-installed with these?
Windows XP - .NET 1.0
Windows vista - .NET 2.0
Windows 7 - .NET 3.5 (which includes 2.0)
Windows 8 / 8.1 - .NET 4.0+
Windows 10 - .NET 4.5+ (backwards compatible with 4.0)
(Thanks quicksilver!)
some linux distros - java (pls no java malware)
Languages and their dependencies
C++ - most of the time native, could be VC++ though
C - Native
Assembly (FASM, NASM, MASM etc) - Native
Delphi - Native
AutoIT - Native but quite large file size compared to c, cpp etc
Go - Native but absolutely massive file size 3mb+ generally.
vb.net - .net
C# - .net
F# - .net
python - you need to install python (please, never write malware in python, unless you use pyinstaller)
tl:dr
- don't crypt native malware with .net crypter
- just because there is apparently 98% of computers have .net installed does not mean anything, .net is not completely reverse compatible
- if you want as high execution rate go with something native like C++, C, assembly etc
There might be some incorrect information / spelling or grammar mistakes - I'm open to constructive crit
regards, blez 🤝
* - 7 - Nov 18, 2016
Good post. I know this is obvious for a lot of us users but there are many who still do not get it.
Very useful.
* - SIM-297877 - Nov 18, 2016
Go is fully native, also cross-platform.
* - 7 - Nov 18, 2016
(Nov 18, 2016 11:34 AM)SaturnsVoid Wrote: Go is fully native, also cross-platform.
Yeah??? Nice. Look into that. Your botnet is Go ?
* - SIM-297877 - Nov 18, 2016
(Nov 18, 2016 11:37 AM)NulldB Wrote: Yeah??? Nice. Look into that. Your botnet is Go ?
Yeah, i switched to only coding in Go. Love it vary powerful just needs more people to adopt it.
Check out Go here: https://golang.org/
* - Slavoj Žižek - Nov 18, 2016
(Nov 18, 2016 11:38 AM)SaturnsVoid Wrote: Yeah, i switched to only coding in Go. Love it vary powerful just needs more people to adopt it.
I heard it once or twice until I saw your thread, how big are the file size? like AutoIT? 🤝
* - SIM-297877 - Nov 18, 2016
(Nov 18, 2016 11:40 AM)Blezzedd Wrote: I heard it once or twice until I saw your thread, how big are the file size? like AutoIT? 🤝
Yeah about, Though they drop about 5-10% each compiler update it seems.... Most large-scale applications will be around 5mb, but they compress good.
* - bzrΚ - Nov 18, 2016
Nice thread that is really informative. Will hopefully educate a lot of users about this area.
* - Purple Kief - Nov 18, 2016
If you made this you did a really good job.
Hope to see more of this.
* - Slavoj Žižek - Nov 18, 2016
(Nov 18, 2016 11:52 AM)Purple Kief Wrote: If you made this you did a really good job.
Hope to see more of this.
thanks m80, its all mine
* - Qismon - Nov 18, 2016
I agree with everything you said except for the python malware.....I have one that is written in python, very stable, and no need for python to be installed on client PC......compiled with pyinstaller......works on XP - Win10.
* - Slavoj Žižek - Nov 18, 2016
(Nov 18, 2016 12:09 PM)pdapentester Wrote: I agree with everything you said except for the python malware.....I have one that is written in python, very stable, and no need for python to be installed on client PC......compiled with pyinstaller......works on XP - Win10.
You have a point, I have changed it 🤝
* - QU⚡CKSILVER - Nov 18, 2016
(Nov 18, 2016 11:27 AM)Blezzedd Wrote: (some frameworks come packaged with other ones, for example the .net 2.0 installer also installs 3.5)
It's actually the other way around. 3.5 includes 2.0
(Nov 18, 2016 11:27 AM)Blezzedd Wrote: when it comes to windows XP its best to have non-dependant malware since its pre-installed with no .net frameworks.
It actually comes with the very first .NET framework (1.0) but your point is valid, it's always best to use native apps to target WinXP and below.
(Nov 18, 2016 11:27 AM)Blezzedd Wrote: Ok then, what OS'es come pre-installed with these?
windows XP - nothing
windows vista - (dont bother, nothing)
windows 7 - .net 2.0
windows 8 / 8.1 - .net 3.0
windows 10 - .net 4.5 (or 4.0 I really cannot remember)
some linux distros - java (pls no java malware)
Windows XP - .NET 1.0
Windows vista - .NET 2.0
Windows 7 - .NET 3.5 (which includes 2.0)
Windows 8 / 8.1 - .NET 4.0+
Windows 10 - .NET 4.5+
* - Slavoj Žižek - Nov 19, 2016
(Nov 18, 2016 05:10 PM)QU⚡CKSILVER Wrote: It's actually the other way around. 3.5 includes 2.0
It actually comes with the very first .NET framework (1.0) but your point is valid, it's always best to use native apps to target WinXP and below.
Windows XP - .NET 1.0
Windows vista - .NET 2.0
Windows 7 - .NET 3.5 (which includes 2.0)
Windows 8 / 8.1 - .NET 4.0+
Windows 10 - .NET 4.5+
thanks for the correction man, updated thread 🤝
* - TheHolyTrinity - Nov 19, 2016
The whole Java thing is fair but spreading to Minecrafters with Java malware is actually really powerful as Java stays FUD for large periods of time. I've written my own malware in Java over 2 years ago and still has 0/35 detections, I haven't had to change anything and I get large executions rates across all platforms.
I understand that the average person trying to spread doesn't always use Minecraft but if you have that option it is extremely effective because of Java's ability to practically bypass all antiviruses. Plus if the Java malware is written effectively it should work on most installations no matter what operating system is running.