+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Cryptography, Encryption, and Decryption (https://hackforums.net/forumdisplay.php?fid=126)
+---- Thread: Digital Certification Singer v1.5 (/showthread.php?tid=5498179)
Pages: Pages
1
2
Digital Certification Singer v1.5 - Tee Plow - Dec 19, 2016
hello
today i release to you this tool a coded longtime ago
it will sign any file you want with a Digital Certification you grab from a signed file like : google chrome,skype, any signed product
this will make your file bypass some AV's
Screenshot :
![[Image: 8eoAvXK.png]](https://i.imgur.com/8eoAvXK.png)
download : https://mega.nz/#!UB1XTDQI!3JgjMJ42WfwFNNZ7K5RMa0kYnz3gvLoXHwrMH-r0cN4
pass : teeplow
* - Twistd - Dec 19, 2016
May I ask which AV's?
Because i have some serious problems understanding how signing a file with an invalid certificate is going to bypass anything runtime when antiviruses are checking the legitimacy of the certificates.
I'd rather think it'd do more harm than good.
* - Tee Plow - Dec 19, 2016
(Dec 19, 2016 07:59 AM)Twistd Wrote: May I ask which AV's?
Because i have some serious problems understanding how signing a file with an invalid certificate is going to bypass anything runtime when antiviruses are checking the legitimacy of the certificates.
I'd rather think it'd do more harm than good.
just try it and u will see
* - xHeaven - Dec 19, 2016
Interesting.
Before: https://www.pscan.xyz/results.php?id=kOmdMCyjABBJLIFm
After: https://www.pscan.xyz/results.php?id=kqYRZmeNDlNsOCkK
* - LanMan - Dec 19, 2016
(Dec 19, 2016 07:59 AM)Twistd Wrote: May I ask which AV's?
Because i have some serious problems understanding how signing a file with an invalid certificate is going to bypass anything runtime when antiviruses are checking the legitimacy of the certificates.
I'd rather think it'd do more harm than good.
Yea, that actually did bypass 3-4 unknown shitty AVs on virustotal when i tested it.
But thats for extremely detected stub (tested with a DC stub), otherwise you are right and it may cause more trouble than good ..
Edit: Yea, xHeaven post.
* - Tee Plow - Dec 19, 2016
(Dec 19, 2016 10:20 AM)LanMan Wrote: Yea, that actually did bypass 3-4 unknown shitty AVs on virustotal when i tested it.
But thats for extremely detected stub (tested with a DC stub), otherwise you are right and it may cause more trouble than good ..
Edit: Yea, xHeaven post.
in the past i was using it to bypass Total Security 360 runtime
* - LanMan - Dec 19, 2016
(Dec 19, 2016 10:55 AM)Tee Plow Wrote: in the past i was using it to bypass Total Security 360 runtime
Oh really ?
Anyway that's a free release, that's cool, it will maybe be useful for someone. 🤝
* - Twistd - Dec 19, 2016
(Dec 19, 2016 10:20 AM)LanMan Wrote: Yea, that actually did bypass 3-4 unknown shitty AVs on virustotal when i tested it.
But thats for extremely detected stub (tested with a DC stub), otherwise you are right and it may cause more trouble than good ..
Edit: Yea, xHeaven post.
Why would you think bypass means scantime? :(
(Dec 19, 2016 10:55 AM)Tee Plow Wrote: in the past i was using it to bypass Total Security 360 runtime
Will never work. Try to activate startup and youll get wrecked with or without a signed stub.
* - sobolek - Dec 19, 2016
(Dec 19, 2016 10:11 AM)xHeaven Wrote: Interesting.
Before: https://www.pscan.xyz/results.php?id=kOmdMCyjABBJLIFm
After: https://www.pscan.xyz/results.php?id=kqYRZmeNDlNsOCkK
What about that??
* - xHeaven - Dec 19, 2016
(Dec 19, 2016 04:32 PM)sobolek Wrote: What about that??
Are you blind?
OP wrote
(Dec 19, 2016 07:21 AM)Tee Plow Wrote: this will make your file bypass some AV's
My scans
(Dec 19, 2016 10:11 AM)xHeaven Wrote: Before: https://www.pscan.xyz/results.php?id=kOmdMCyjABBJLIFm
After: https://www.pscan.xyz/results.php?id=kqYRZmeNDlNsOCkK
Before signing with a certificate (which always invalid btw), I got 12/35.
After signing, I got 15/35.
So this method isn't bypass any AV's, but trigger some AV's. Not a bad share btw, but a little useless, I think. [This is my opinion.]
* - Tee Plow - Dec 19, 2016
(Dec 19, 2016 05:34 PM)xHeaven Wrote: Are you blind?
OP wrote
My scans
Before signing with a certificate (which always invalid btw), I got 12/35.
After signing, I got 15/35.
So this method isn't bypass any AV's, but trigger some AV's. Not a bad share btw, but a little useless, I think. [This is my opinion.]
u are wrong actually
just try it with another file
i won't share something that is useless
before : https://scan.majyx.net/scans/result/32d6dded2aecb92403aa7e5a581a750f070c845c
after : https://scan.majyx.net/scans/result/2e0872880d1041ebbae0fe0992e98acb4be994d0
* - xHeaven - Dec 19, 2016
(Dec 19, 2016 05:51 PM)Tee Plow Wrote: u are wrong actually
just try it with another file
i won't share something that is useless
before : https://scan.majyx.net/scans/result/32d6dded2aecb92403aa7e5a581a750f070c845c
after : https://scan.majyx.net/scans/result/2e0872880d1041ebbae0fe0992e98acb4be994d0
Okay, and what's wrong with my file? Why I get more detections with the signed file? Maybe I'll try with some other files later.
* - Tee Plow - Dec 19, 2016
(Dec 19, 2016 06:04 PM)xHeaven Wrote: Okay, and what's wrong with my file? Why I get more detections with the signed file? Maybe I'll try with some other files later.
maybe the file you grabbed the certification from
try with google chrome,skype,or even an AV like in my example i'm using Total Scurity 360 certification
* - LanMan - Dec 19, 2016
(Dec 19, 2016 01:43 PM)Twistd Wrote: Why would you think bypass means scantime? :(
I don't, we were just talking about scantime and emulation results, well if you have a 45/56 stub at scantime, runtime isn't your priority haha 😁
* - xHeaven - Dec 19, 2016
(Dec 19, 2016 06:07 PM)Tee Plow Wrote: maybe the file you grabbed the certification from
try with google chrome,skype,or even an AV like in my example i'm using Total Scurity 360 certification
The original file is a Quasar RAT stub, I tried to sign with a Google Chrome certification. I'm totally confused, lol.
I tried with an another file, same results.. [Google Chrome cert.]
Before: https://www.pscan.xyz/results.php?id=KGENeMYNyRGZcpKh
After: https://www.pscan.xyz/results.php?id=ncdfoccOXVfeCCAP
And with the same file, with an another certification [Avast]
Before: https://www.pscan.xyz/results.php?id=KGENeMYNyRGZcpKh
After: https://www.pscan.xyz/results.php?id=xdKwxYBTiXASiFPD
Lol, interesting.. O.o IDK, thanks for the share, I'm going to sleep.