Hack Forums
How to update Stub when Crypted ? - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Botnets and Botting (https://hackforums.net/forumdisplay.php?fid=92)
+---- Thread: How to update Stub when Crypted ? (/showthread.php?tid=5825316)

Pages: Pages 1 2


How to update Stub when Crypted ? - Dezinator - Apr 15, 2018

Hey Guys,

Got a little Question. Most Botnets got a Function to update the Botnet Stub. Good Idea for sure but how is it possible to use this?

If I crypt my Stub the Bot is working. When the stub now would get detected how could I remove the Old stub and update with the new one without losing the Bot ? When I would use something like Botkill all process which are not connected with the Bot would get killed. If this happend how can I update the new one ? Seems like this is not possible or did I missed something ? Also after Crypting and Injection the new Stub would not get accepted if the old Bot Stub is still running. Hope I got my point clear.

Greetings


RE: How to update Stub when Crypted ? - Raoul Duke - Apr 15, 2018

You need to update your stub very often BEFORE it gets detected. Once you get detected the remote connection will be blocked and you will loose any control you had on this target.


RE: How to update Stub when Crypted ? - GlobalLine - Apr 15, 2018

(Apr 15, 2018 11:08 AM)Dezinator Wrote:  Hey Guys,

Got a little Question. Most Botnets got a Function to update the Botnet Stub. Good Idea for sure but how is it possible to use this?

If I crypt my Stub the Bot is working. When the stub now would get detected how could I remove the Old stub and update with the new one without losing the Bot ? When I would use something like Botkill all process which are not connected with the Bot would get killed. If this happend how can I update the new one ? Seems like this is not possible or did I missed something ? Also after Crypting and Injection the new Stub would not get accepted if the old Bot Stub is still running. Hope I got my point clear.

Greetings

Lol. What?
If your stub gets detected by an AV, the AV doesn't just mark it as detected. It wipes that shit off the hard drive.

If your stub gets detected, then your bot is gone on that computer. Period. You can't update it unless they manually install a fresh copy of it.


RE: How to update Stub when Crypted ? - sssniperwolf - Apr 15, 2018

(Apr 15, 2018 05:53 PM)GlobalLine Wrote:  Lol. What?
If your stub gets detected by an AV, the AV doesn't just mark it as detected. It wipes that shit off the hard drive.

If your stub gets detected, then your bot is gone on that computer. Period. You can't update it unless they manually install a fresh copy of it.

Yes the AV will remove the detected stub but the new updated undetected stub will remain on his computer


RE: How to update Stub when Crypted ? - Dezinator - Apr 15, 2018

Okay get this but how do i update this with out my stub get removed when its crypted ?


Also not every botkill remove stubs which are Injected in some major Process ?


Its not possible to update stub when the main process of the Bot ( for example Betabot is still running on the System)


RE: How to update Stub when Crypted ? - sssniperwolf - Apr 15, 2018

(Apr 15, 2018 06:49 PM)Dezinator Wrote:  Okay get this but how do i update this with out  my stub get removed  when its crypted ?


Also not every botkill remove stubs which are Injected in some major Process ?


Its not possible to update stub when the main process of the Bot ( for example Betabot is still running on the System)

You say you cant update the stub because there is already a stub running on their system? I haven't used betabot in over 3 years but im pretty sure it has a basic update / download / uninstall option you are probably running a cracked betabot which is completely useless


RE: How to update Stub when Crypted ? - AnonTri - Apr 15, 2018

(Apr 15, 2018 07:05 PM)sssniperwolf Wrote:  You say you cant update the stub because there is already a stub running on their system? I haven't used betabot in over 3 years but im pretty sure it has a basic update / download / uninstall option you are probably running a cracked betabot which is completely useless

He didn't mention BB.

OP If you are using startup on your bot just run update. Otherwise run update and if the old bot reconnects uninstall it. Simple as that.


RE: How to update Stub when Crypted ? - Dezinator - Apr 15, 2018

Buddy its just one Question. If my Stub is crypted with a Injection in a Normal Process, it is not possible to kill it with Botkill.If it gets detected from AV it will be removed. So I will lost the bot. So how do I update the Bot with Killing the Old Process and Update with the new one ?


If I update it with the new stub and the old one is not removed with the Botkill the new FUD Stub will not be accepted from the System


RE: How to update Stub when Crypted ? - sssniperwolf - Apr 15, 2018

(Apr 15, 2018 07:21 PM)Dezinator Wrote:  Buddy its just one Question. If my Stub is crypted with a Injection in a Normal Process, it is not possible to kill it with Botkill.If it gets detected from AV it will be removed. So I will lost the bot.  So how do I update the Bot with Killing the Old Process and Update with the new one ?


If I update it with the new stub and the old one is not removed with the Botkill the new FUD Stub will not be accepted from the System

I understand what your saying, which bot are you running and version#


RE: How to update Stub when Crypted ? - Dezinator - Apr 16, 2018

For Example Betabot

25 Characters..


RE: How to update Stub when Crypted ? - MrPatterson - Apr 18, 2018

I'm guessing you should look at using a better bot than Betabot, I think it would solve the problem you're describing.


RE: How to update Stub when Crypted ? - Zettabit - Apr 19, 2018

The update function of most bots purposely uninstalls the old bot from the system, and then starts the new bot. If it's injected into a process, it should exit that process and remove all traces of the old file from the system.

If your bot isn't doing this, then I don't know what the fuck you're using but it's trash.


RE: How to update Stub when Crypted ? - sssniperwolf - Apr 19, 2018

(Apr 19, 2018 12:47 PM)Zettabit Wrote:  The update function of most bots purposely uninstalls the old bot from the system, and then starts the new bot. If it's injected into a process, it should exit that process and remove all traces of the old file from the system.

If your bot isn't doing this, then I don't know what the fuck you're using but it's trash.

He keeps saying betabot which is probably a cracked version so the update feature doesn't work.


RE: How to update Stub when Crypted ? - MrPatterson - Apr 19, 2018

(Apr 19, 2018 12:47 PM)Zettabit Wrote:  The update function of most bots purposely uninstalls the old bot from the system, and then starts the new bot. If it's injected into a process, it should exit that process and remove all traces of the old file from the system.

If your bot isn't doing this, then I don't know what the fuck you're using but it's trash.

Out of interest, what bot would you recommend?


RE: How to update Stub when Crypted ? - Dezinator - Apr 21, 2018

(Apr 19, 2018 04:46 PM)sssniperwolf Wrote:  He keeps saying betabot which is probably a cracked version so the update feature doesn't work.

You dont understand. How should the Update Function in Betabot know where I inject my FUD Stub ? And If the Update Function is not able to delete my Stub, the System will reject a new Stub a