+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Cryptography, Encryption, and Decryption (https://hackforums.net/forumdisplay.php?fid=126)
+---- Thread: [Development thread] Gasolyne - C/ASM crypter (/showthread.php?tid=5870010)
[Development thread] Gasolyne - C/ASM crypter - Jean-Jacques Rousseau - Aug 4, 2018
Hey.
Yesterday I decided to code a crypter (for the lols of it), and I just finished the base. In this thread I will post my progress when developing this cryper.
Small details:
- Written in Visual C/C++ and x86_32 ASM.
Current features:
- Encryption/Decryption routine in x86_32.
- Malware is stored using the resource method.
- Malware is dropped to disk after decryption.
I was honestly expecting it to be fully detected when I first scanned it, however, it showed up as 11/32 scantime.
i.gyazo. com/ f227be7035813a8c5b5ea36733939830.png
This is Gaudox crypted. The stub is compiled to debug - it has not been stripped.
What i am aiming for in the near future:
- Unique RunPE
- Changing the decryption routine to something like Luminous crypter, to mess upp the emulators
- Call the functions dynamically, bypass some hooks.
My end-goals:
- Calling the functions via syscalls for both x86_64 and x86_32 (still researching about the 0x33 segment!)
- Some Anti-debug/Anti-VM features.
The crypter is called Gasolyne. I dont know what I will do with it - might sell or release.
I am open to learning!
EDIT: A word.
To clarify for those who dont know how the Luminous crypter works, I will essentially brute-force key.
RE: [Development thread] Gasolyne - C/ASM crypter - 3DES - Aug 4, 2018
Calling APIs dynamically wont do jack shit dude if you are trying to bypass with that. Preferably read syscall numbers from ntdll and use them to bypass hooks.
RE: [Development thread] Gasolyne - C/ASM crypter - Jean-Jacques Rousseau - Aug 4, 2018
(Aug 4, 2018 11:04 AM)3DES Wrote: Calling APIs dynamically wont do jack shit dude if you are trying to bypass with that. Preferably read syscall numbers from ntdll and use them to bypass hooks.
Yeah, that’s why I wanted to use direct syscall, but I havent really ”mastered” the topic yet.
RE: [Development thread] Gasolyne - C/ASM crypter - 3DES - Aug 4, 2018
You also might want to use LoadPE instead of runpe(ITS ANCIENT!)
RE: [Development thread] Gasolyne - C/ASM crypter - int - Aug 4, 2018
dropping the malware executable removes the entire point of running in memory
RE: [Development thread] Gasolyne - C/ASM crypter - Jean-Jacques Rousseau - Aug 4, 2018
(Aug 4, 2018 11:53 AM)Jukeboxhook Wrote: dropping the malware executable removes the entire point of running in memory
Lol, it was just the base, to make sure everything went fine. I am not a retard.
(Aug 4, 2018 11:45 AM)3DES Wrote: You also might want to use LoadPE instead of runpe(ITS ANCIENT!)
It sure is, will add that in the end.
RE: [Development thread] Gasolyne - C/ASM crypter - Uiqueblhats - Aug 4, 2018
Mate can you pm me the link to luminous crypter heard a lot of good stories about it
RE: [Development thread] Gasolyne - C/ASM crypter - Jean-Jacques Rousseau - Aug 4, 2018
(Aug 4, 2018 12:47 PM)Uiqueblhats Wrote: Mate can you pm me the link to luminous crypter heard a lot of good stories about it
I cant pm. The crypter has been posted on a load of forums (including this one) multiple times.
RE: [Development thread] Gasolyne - C/ASM crypter - Uiqueblhats - Aug 4, 2018
(Aug 4, 2018 02:12 PM)Supercut Wrote: I cant pm. The crypter has been posted on a load of forums (including this one) multiple times.
Post the link here only please
RE: [Development thread] Gasolyne - C/ASM crypter - Jean-Jacques Rousseau - Aug 5, 2018
(Aug 4, 2018 03:25 PM)Uiqueblhats Wrote: Post the link here only please
showthread.php?tid=5722311
RE: [Development thread] Gasolyne - C/ASM crypter - Uiqueblhats - Aug 5, 2018
(Aug 5, 2018 05:16 AM)Supercut Wrote: showthread.php?tid=5722311
thanks mate it will really help me
RE: [Development thread] Gasolyne - C/ASM crypter - Jean-Jacques Rousseau - Aug 5, 2018
(Aug 5, 2018 06:54 AM)Uiqueblhats Wrote: thanks mate it will really help me
Happy coding!
Update: trying to implement a runpe, having some issues. The code looks just fine, however, my test file does not execute. Will look at other sources to see how they do it.
RE: [Development thread] Gasolyne - C/ASM crypter - Twistd - Aug 5, 2018
What exact part of your crypter is assembly?
RE: [Development thread] Gasolyne - C/ASM crypter - Jean-Jacques Rousseau - Aug 5, 2018
(Aug 5, 2018 01:46 PM)Twistd Wrote: What exact part of your crypter is assembly?
The encryption/decryption routine, and soon, the syscalls (that will replace functions).
UPDATE: Implemented a RunPE, code gets executed. Everything looks fine!
New scan!
4/32
i.gyazo .com/ 8b1aaf859b39ea5eebc28c55dc26067b.png
I will add an anti-emulation method that Luminous invented. Hopefully it can bypass AVs runtime.
RE: [Development thread] Gasolyne - C/ASM crypter - Twistd - Aug 6, 2018
(Aug 5, 2018 11:49 PM)Supercut Wrote: The encryption/decryption routine, and soon, the syscalls (that will replace functions).
UPDATE: Implemented a RunPE, code gets executed. Everything looks fine!
New scan!
4/32
i.gyazo .com/ 8b1aaf859b39ea5eebc28c55dc26067b.png
I will add an anti-emulation method that Luminous invented. Hopefully it can bypass AVs runtime.
That will replace api calls you mean? I don't see any specific reason why you would want to use assembly for the encryption/decryption routine. Please elaborate
Anti emulation won't bypass anything runtime.