Hack Forums
Cleardrop Crypter | FREE | x86/32-bit | Managed/.NET | Interchangeable Stub+ - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Hacking Tools and Programs (https://hackforums.net/forumdisplay.php?fid=10)
+---- Thread: Cleardrop Crypter | FREE | x86/32-bit | Managed/.NET | Interchangeable Stub+ (/showthread.php?tid=5793753)

Pages: Pages 1 2 3

Cleardrop Crypter | FREE | x86/32-bit | Managed/.NET | Interchangeable Stub+ - gigajew - Feb 1, 2018

[Image: hjUOwt7.png]


Cleardrop Crypter, a project I've thrown together from some code I've wanted to experiment with. It's got built-in protection, light obfuscation (renaming), some slight USG and more. I'm not held responsible for how you use this experimental tool. It wasn't built to hack people's computers, it was built to see if it withstands public testing. I'd appreciate if you post in this thread if any errors occur, if you have any problems with anything, etc. By downloading, sharing, copying, using or otherwise modifying this software you agree to not use it for any illegal purposes. This is a software that is capable of generating malware, and it is illegal to use it, or any software produced by it on any devices or property that you do not own.

It does NOT support:
  • EOF

  • 64-bit based applications

  • Automatic startup (because it's not really meant for spreading or infecting people)



It DOES support:
  • 32-bit based assemblies

  • .NET and native assemblies



Features (if you didn't read above)
  • Light obfuscation

  • Light anti-virtualization

  • Anti-emulation

  • Anti-debugging

  • Custom cryptography method

  • Ability to choose a custom stub (in case of updates, or alternative stubs)



It's currently 7/66 as of 02/13/2018, and I'm interested to see how the detection rate develops as more people try it out, submit samples and what not.

Download project: https://files.catbox.moe/wb9s2b.7z (password: gigajew)
Scanned stub: https://www.virustotal.com/#/file/43dd574dfd2f226fb448f025d475cc06c46d67da5c3b3fd6398540665d84a864/detection

[Image: iz5xYcBtbmMRXW7N0paJ4f9.png]


RE: Cleardrop Crypter | FREE | x86/32-bit | Managed/.NET | Interchangeable Stub+ - Smileツ - Feb 1, 2018

Thanks for the crypter , i will try for sure.
It's .net ?

RE: Cleardrop Crypter | FREE | x86/32-bit | Managed/.NET | Interchangeable Stub+ - gigajew - Feb 1, 2018

(Feb 1, 2018 08:58 PM)dåFu™ Wrote:  Thanks for the crypter , i will try for sure.
It's .net ?

The crypter and stub are .NET Framework version 4.0. I've tested both native and managed executables and they both run. Works well with Quasar actually.

RE: Cleardrop Crypter | FREE | x86/32-bit | Managed/.NET | Interchangeable Stub+ - Smileツ - Feb 1, 2018

(Feb 1, 2018 09:04 PM)gigajew Wrote:  The crypter and stub are .NET Framework version 4.0. I've tested both native and managed executables and they both run. Works well with Quasar actually.

Possible to add 2.0 too so i try to bind them ?

RE: Cleardrop Crypter | FREE | x86/32-bit | Managed/.NET | Interchangeable Stub+ - Adlies - Feb 1, 2018

Thanks for this free cryptor, I'll give it a test now

RE: Cleardrop Crypter | FREE | x86/32-bit | Managed/.NET | Interchangeable Stub+ - gigajew - Feb 1, 2018

Delaying release, wait for more information

RE: Cleardrop Crypter | FREE | x86/32-bit | Managed/.NET | Interchangeable Stub+ - Vagabundo Legendario - Feb 1, 2018

I would like to test it thanks

RE: Cleardrop Crypter | FREE | x86/32-bit | Managed/.NET | Interchangeable Stub+ - Arkane21 - Feb 1, 2018

Hey I want to test this and scan on virus checkmate.

Thanks,

Arkane21

RE: Cleardrop Crypter | FREE | x86/32-bit | Managed/.NET | Interchangeable Stub+ - Takehito Morokuzu - Feb 2, 2018

I can test this for you, is it runtime UD? Also if I get this can I spread it or just test for you?

RE: Cleardrop Crypter | FREE | x86/32-bit | Managed/.NET | Interchangeable Stub+ - gigajew - Feb 2, 2018

Released again. And to answer your question, it is illegal to spread or execute malware on any devices you do not own, or have consent from the rightful owner of. I'll leave it at that.

As for .NET 2.0 here's a legacy stub that you can use: https://files.catbox.moe/0ohcet.7z (password: gigajew)

RE: Cleardrop Crypter | FREE | x86/32-bit | Managed/.NET | Interchangeable Stub+ - Takehito Morokuzu - Feb 2, 2018

(Feb 2, 2018 03:37 PM)gigajew Wrote:  Released again. And to answer your question, it is illegal to spread or execute malware on any devices you do not own, or have consent from the rightful owner of. I'll leave it at that.

As for .NET 2.0 here's a legacy stub that you can use: https://files.catbox.moe/0ohcet.7z (password: gigajew)

Yes I already knew that. But that's what a crypter is designed for. If it's what some people say "protecting your binary" well that's not true because most crypters include malicious function and they get detected by antiviruses after a while anyway which defeats the purpose because people are going to think it's malware even if it's not.

It's not working, it says The application was unable to start correctly 0xc0000005 on the crypted file

RE: Cleardrop Crypter | FREE | x86/32-bit | Managed/.NET | Interchangeable Stub+ - gigajew - Feb 2, 2018

(Feb 2, 2018 04:44 PM)therulerofall Wrote:  Yes I already knew that. But that's what a crypter is designed for. If it's what some people say "protecting your binary" well that's not true because most crypters include malicious function and they get detected by antiviruses after a while anyway which defeats the purpose because people are going to think it's malware even if it's not.

It's not working, it says The application was unable to start correctly 0xc0000005 on the crypted file

That’s a bug in the runpe, it happens because you’re supposed to have a delay in a runpe at a certain part, but this one is shellcode so I wouldn’t know how to add one to it. You’ll see the same problem with almost all other runpes. All you can do is just start it again

RE: Cleardrop Crypter | FREE | x86/32-bit | Managed/.NET | Interchangeable Stub+ - Takehito Morokuzu - Feb 2, 2018

(Feb 2, 2018 05:18 PM)gigajew Wrote:  That’s a bug in the runpe, it happens because you’re supposed to have a delay in a runpe at a certain part, but this one is shellcode so I wouldn’t know how to add one to it. You’ll see the same problem with almost all other runpes. All you can do is just start it again

Ah it's working now, just didn't work the first time.

RE: Cleardrop Crypter | FREE | x86/32-bit | Managed/.NET | Interchangeable Stub+ - gigajew - Feb 2, 2018

If anyone wants to make graphics or UI for it I wouldn’t mind adding it

RE: Cleardrop Crypter | FREE | x86/32-bit | Managed/.NET | Interchangeable Stub+ - SIM-2294117 - Feb 2, 2018

Love it! Detection ratio of 2/64, very well made for something that's free!