+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Cryptography, Encryption, and Decryption (https://hackforums.net/forumdisplay.php?fid=126)
+---- Thread: How to crypt a Miner/LuminosityLink (/showthread.php?tid=5615703)
Pages: Pages
1
2
How to crypt a Miner/LuminosityLink - _Raz0r - May 5, 2017
Hello, I'm french and I have bought the Miner (ROGUE MINER) & LuminosityLink.
I have also bought the crypter Spartan Crypter.
The crypter works fine, no crash and FUD but I have a problem :
Miner is FUD and Luminosity is FUD but twice aren't working on a computer with Avast and I don't understand.
Avast don't detect himself that is a RAT or Miner, no notification but when I launch the Miner or Luminosity build which are crypt and FUD, if Avast's modules are enable, Luminosity & the Miner close but no notification. And if I launch the Miner or Luminosity with Avast disabled, the Miner & Luminosity works fine.
Do you have an idea ?
Thank's you !
* - Տnow - May 5, 2017
Its the avast then... Somethings not FUD in your setup
* - Frankey - May 5, 2017
Im not some kind of professional so correct me if I'm wrong.
But maybe the file is only scantime FUD and not Runtime?
Or maybe there are settings within the crypter which are messing things up.
* - _Raz0r - May 5, 2017
(May 5, 2017 05:02 AM)Տnow Wrote: Its the avast then... Somethings not FUD in your setup
Yes but how to know if everything is FUD if the scanner says 0/40 ?
(May 5, 2017 05:02 AM)Frankey Wrote: Im not some kind of professional so correct me if I'm wrong.
But maybe the file is only scantime FUD and not Runtime?
Or maybe there are settings within the crypter which are messing things up.
If you explain me how to scan a Runtime, maybe it will works ^^'
* - SIM-3432714 - May 5, 2017
Is that miner dropping detected files?
* - Mitlar - May 5, 2017
Last I checked spartan crypter was detected by avast on runtime.
* - _Raz0r - May 5, 2017
(May 5, 2017 06:52 AM)potkan Wrote: Is that miner dropping detected files?
I don't really understand what you mean, but when the miner is detected, miner is stopping working and it's deleted.
(May 5, 2017 07:31 AM)Lϻғϑλσ Wrote: Last I checked spartan crypter was detected by avast on runtime.
Thank's you.
I have add you on skype.
* - Ciaransbank - May 5, 2017
i can crypt miners for anyone needing them email me at [email protected]
* - malusdefou - May 6, 2017
Hi there 🤝,
Earm ... I recommend you to firstly disable telemetry and sending client infos and samples to avast service from avast settings if you use the crypter and your crypted file on your own, you're just sending samples to avast and making the crypting method detected .
AVs mostly have runtime modules that detects popular shemas of RAT's / Ransomwares / Miners / Wormes etc ... they analysed, so when the AV is activated, if you open a popular malware such as DarkComet or Nanocore or Lumonisity Link that has been scanned at AV's laboratories of sample analysing, so the schema is knows and modules are made to prevent their runtime execution.
It isn't a proof of non detection that scantime shows you a very low detection rate, patterns of popular malware payloads are known (which registry key is manipulated, dropping folder etc ...).
So, try using a non popular RAT, crypt it and try executing it with avast activated then give us news about it.(with my first recommendations about disabling cloud scanning of Avast to prevent your file being leaked 😠).
I forgot to talk about another thing, check if it's the Avast Firewall who prevent the malicious traffic of your malware to arrive to you ... So, the malware works but the traffic doesn't leave the infected machine so you can't manipulate it. But this reason isn't an excuse for a silent crypto-miner to stop, this one should maybe be stopped because of his CPU usage if it's a Cpu mining payload ... 😧
Peace&3XPL0ITS 🎉
* - _Raz0r - May 8, 2017
(May 5, 2017 11:02 AM)Ciaransbank Wrote: i can crypt miners for anyone needing them email me at [email protected]
Thank's you, I mail you for more informations.
(May 6, 2017 02:15 PM)malusdefou Wrote: Hi there 🤝,
Earm ... I recommend you to firstly disable telemetry and sending client infos and samples to avast service from avast settings if you use the crypter and your crypted file on your own, you're just sending samples to avast and making the crypting method detected .
AVs mostly have runtime modules that detects popular shemas of RAT's / Ransomwares / Miners / Wormes etc ... they analysed, so when the AV is activated, if you open a popular malware such as DarkComet or Nanocore or Lumonisity Link that has been scanned at AV's laboratories of sample analysing, so the schema is knows and modules are made to prevent their runtime execution.
It isn't a proof of non detection that scantime shows you a very low detection rate, patterns of popular malware payloads are known (which registry key is manipulated, dropping folder etc ...).
So, try using a non popular RAT, crypt it and try executing it with avast activated then give us news about it.(with my first recommendations about disabling cloud scanning of Avast to prevent your file being leaked 😠).
I forgot to talk about another thing, check if it's the Avast Firewall who prevent the malicious traffic of your malware to arrive to you ... So, the malware works but the traffic doesn't leave the infected machine so you can't manipulate it. But this reason isn't an excuse for a silent crypto-miner to stop, this one should maybe be stopped because of his CPU usage if it's a Cpu mining payload ... 😧
Peace&3XPL0ITS 🎉
Thank's you for your answer ;)
* - Copa Ammrica - Jun 19, 2017
Where you able to solve this issue?
* - _Raz0r - Jun 19, 2017
Yes, for Luminosity Link I just changed the cryper
* - Copa Ammrica - Jun 20, 2017
I love French people when ti comes to good tools
* - AnonLiv3 - Jun 21, 2017
(May 5, 2017 07:31 AM)clay jensen Wrote: Last I checked spartan crypter was detected by avast on runtime.
Hnmmm Bro please can you suggest a crypter that is FUD in runtime 99.9% because i have been loosing installs with spartan lately despite using the installation on crypter and i use a c++ RAT ..
please lead me through and i will like to know does Data protector stay FUD always and works for C++ and .net
hoping for a positive response.
Regards
* - _Raz0r - Jun 23, 2017
I have bought Data protector, it's a big ****, break Miner, and nosferatu remove my license because this idiot thinks that I do spreading