(Aug 13, 2018 01:03 PM)ShadoBlH Wrote:  Thanks for sharing this, however, dropping files and spawning process from resources will trigger most of the time
AV's proactive defense also i liked the ur method to set values in register with a non-traditional method by using StrReverse function.

Good Job .

(Aug 13, 2018 12:54 PM)˗ˏˋ NYAN CAT ˎˊ˗ Wrote:  Hello,

I noticed that VB.NET section is inactive recently, And also didn't see any loader so I want to share with you guys a very simple and straightforward .NET loader. Just to post something here. But I would love to see some suggestions, TBH I'm not that good lol.
:: Download Link ::

---

(Aug 13, 2018 01:03 PM)ShadoBlH Wrote:  Thanks for sharing this, however, dropping files and spawning process from resources will trigger most of the time
AV's proactive defense also i liked the ur method to set values in register with a non-traditional method by using StrReverse function.

Good Job .

(Aug 13, 2018 01:29 PM)˗ˏˋ NYAN CAT ˎˊ˗ Wrote:  Thanks for your feedback, I really appreciate it.  🤝

There are many methods for dropping files but this is the simplest one, however, I always use the startup folder as a drop method for my everyday testing just to make sure that I'm making the loader to be super aggressive, and have no issue with the runtime scan always bypass, But I what noticed is that AV trigger sometimes for this 2 lines

Code

Diagnostics.Process.Start(Path_)
Environment.Exit(0)

Again, Thanks for feedback  🤝

(Aug 13, 2018 02:08 PM)Crytic Coder.. Wrote:  Enough with the .NET malware, I can make one in 10 Minutes with like 5 features and make a crypter to wrap it.. I'd be the richest due of hf..I bet my life on it..

Quote:I noticed that VB.NET section is inactive recently, And also didn't see any loader so I want to share with you guys a very simple and straightforward .NET loader. Just to post something here.

Quote:Enough with the .NET

(Aug 13, 2018 02:18 PM)˗ˏˋ NYAN CAT ˎˊ˗ Wrote:  Hello,
I suppose you didn't read my first and only paragraph, I shall quote it so you read it, sir.

---

As you see, This is the .NET section, You will only find .NET threads. lol, It's like I'm teaching you A B C D this should be obvious It's .NET section

---

EDIT:

PHP Code


<?php 
Reputation: -19 


geez...

(Aug 13, 2018 02:31 PM)Crytic Coder.. Wrote:  Hit dat E G H babe

• You're probably one of the first people here that uses Path.Combine in their source code. Good job!
  
• What's up with all the shared variables? Always try to minimise the scope each variable is accessible to. E.g. Count is only used in the Sleeping function. It would therefore make sense to declare it inside Sleeping rather than in global scope.
  
• What is the point of the Sleeping function in the first place? It always returns true, meaning your if statement in Main is pretty pointless, and it always sleeps for 5 seconds? Couldn't you just have used Thread.Sleep(1000 * 5) in your Main method?
  
• I see every member in a class is marked as Shared. Consider using Module instead of Class which marks all members Shared without explicitly specifying so.
  
• I assume the 35 in Environment.GetFolderPath(35) is used instead of the direct enum field as a means of obfuscation? While it might be effective upon reading the source code, it doesn't matter at low level. Pretty much every decompiler will detect the 35 as a constant that is related to the SpecialFolder.CommonApplicationData enum field, and replace it with the enum constant instead. A rule of thumb is to prefer readability of source code over shortcuts and brevity, which you might want to consider following as well.
  
• In your encryption and compression functions, you are using quite a few instances that implement the IDisposable interface. While you do dispose them, this is not guaranteed to be invoked once an exception occurs. Therefore, always wrap your disposable variables in a Using statement unless you have a really good reason not to.
  

(Aug 14, 2018 04:07 AM)Washi Wrote:  While I know nothing about removing detections because I am really not interested in that topic, I got a couple of comments on your source code:

• You're probably one of the first people here that uses Path.Combine in their source code. Good job!
  
• What's up with all the shared variables? Always try to minimise the scope each variable is accessible to. E.g. Count is only used in the Sleeping function. It would therefore make sense to declare it inside Sleeping rather than in global scope.
  
• What is the point of the Sleeping function in the first place? It always returns true, meaning your if statement in Main is pretty pointless, and it always sleeps for 5 seconds? Couldn't you just have used Thread.Sleep(1000 5) in your Main method?
  
• I see every member in a class is marked as Shared. Consider using Module instead of Class which marks all members Shared without explicitly specifying so.
  
• I assume the 35 in Environment.GetFolderPath(35) is used instead of the direct enum field as a means of obfuscation? While it might be effective upon reading the source code, it doesn't matter at low level. Pretty much every decompiler will detect the 35 as a constant that is related to the SpecialFolder.CommonApplicationData enum field, and replace it with the enum constant instead. A rule of thumb is to prefer readability of source code over shortcuts and brevity, which you might want to consider following as well.
  
• In your encryption and compression functions, you are using quite a few instances that implement the IDisposable interface. While you do dispose them, this is not guaranteed to be invoked once an exception occurs. Therefore, always wrap your disposable variables in a Using statement unless you have a really good reason not to.
  

Also there doesn't seem to be any instructions in the thread on how to use it? There are a few comments here and there in the source code, but it does not really give any explanation on what to change to make it work.

Just my thoughts.

Quote:[*]What is the point of the Sleeping function in the first place? It always returns true, meaning your if statement in Main is pretty pointless, and it always sleeps for 5 seconds? Couldn't you just have used Thread.Sleep(1000 5) in your Main method?

Quote:[*]I see every member in a class is marked as Shared. Consider using Module instead of Class which marks all members Shared without explicitly specifying so.

Quote:[*]I assume the 35 in Environment.GetFolderPath(35) is used instead of the direct enum field as a means of obfuscation? While it might be effective upon reading the source code, it doesn't matter at low level. Pretty much every decompiler will detect the 35 as a constant that is related to the SpecialFolder.CommonApplicationData enum field, and replace it with the enum constant instead. A rule of thumb is to prefer readability of source code over shortcuts and brevity, which you might want to consider following as well.

Quote:Also there doesn't seem to be any instructions in the thread on how to use it? There are a few comments here and there in the source code, but it does not really give any explanation on what to change to make it work.

(Aug 14, 2018 03:04 PM)Mimikyu Wrote:  This is a pretty good contribution OP! Nice work!

(Aug 14, 2018 12:26 PM)˗ˏˋ NYAN CAT ˎˊ˗ Wrote:  I will qoute a post from another thread of mine.
http://prntscr.com/kimc06
So instead of the whole application is sleeping, I'm doing a loop so the function is working and not sleeping but in same time it sleeps for 1sec every loop. I don't know if this really work to add evasion or not.

(Aug 14, 2018 12:26 PM)˗ˏˋ NYAN CAT ˎˊ˗ Wrote:  Yeah, modules are great in VB. But don't usually use.

(Aug 14, 2018 12:26 PM)˗ˏˋ NYAN CAT ˎˊ˗ Wrote:  To be honest, it wasn't about obfuscation, I'm trying to learn to use numbers instead of the special folder to make my line shorter and cleaner.

(Aug 14, 2018 03:28 PM)Washi Wrote:  Could be. Again, I have no idea about this.

(Aug 14, 2018 03:28 PM)Washi Wrote:  Why not?

(Aug 14, 2018 03:28 PM)Washi Wrote:  You should definitely not get used to that! Using the enum constants over raw magic numbers greatly improve readability of your source code. Always imagine yourself reading this source code a few months / years later. You should still be able to understand it from the get go. Magic constants don't help with that :)

(Aug 15, 2018 12:32 PM)Ph3n0mz Wrote:  I tested this by trying to load my RAT server but it's not working, is there anything i'm doing wrong? Is there something i don't know about? Should it be working with a RAT? Thanks to anyone who's going to help me understand.