Hack Forums
[FUD] Simple Method To Bypass AV [PowerShell] - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Cryptography, Encryption, and Decryption (https://hackforums.net/forumdisplay.php?fid=126)
+---- Thread: [FUD] Simple Method To Bypass AV [PowerShell] (/showthread.php?tid=6012035)

Pages: Pages 1 2


[FUD] Simple Method To Bypass AV [PowerShell] - NYANxCAT - Sep 29, 2019

[Image: nnX3zrW.png]



- We will create a Powershell loader using VBS. I tried to make it as simple as I can. Have fun!

[1] Convert your .NET payload to base64
[2] Reverse your base64 string - URL
[3] FUD - Scan Result

[!] Copy + Paste = NO FUD





RE: [FUD] Simple Method To Bypass AV [PowerShell] - Wikeos123 - Sep 29, 2019

I love you NYAN <3 you are the best


RE: [FUD] Simple Method To Bypass AV [PowerShell] - tiny cracker - Sep 29, 2019

great sharing . NAYA CAT is legend and has good contribution for learning on HF and GitHub. love you dude..


RE: [FUD] Simple Method To Bypass AV [PowerShell] - Swado2times - Sep 29, 2019

Loading malware which is detected runtime will be bypassed by a Loader? Wow you have defeated every AV in a single blow!


RE: [FUD] Simple Method To Bypass AV [PowerShell] - ❖Onyx❖ - Sep 29, 2019

Awesome man :) commenting here to save this post. Love your contributions :)


RE: [FUD] Simple Method To Bypass AV [PowerShell] - naxster - Sep 30, 2019

Maybe i'm doing something wrong, but when i saved this as a VBS file i only get errors... :/

The base64 is reveresed and everything, still nothing... I get a popup called "Windows Script Host"


RE: [FUD] Simple Method To Bypass AV [PowerShell] - naxster - Oct 2, 2019

(Sep 29, 2019 02:10 AM)˗ˏˋ NYAN CAT ˎˊ˗ Wrote:  
[Image: nnX3zrW.png]



- We will create a Powershell loader using VBS. I tried to make it as simple as I can. Have fun!

[1] Convert your .NET payload to base64
[2] Reverse your base64 string - Online URL
[3] FUD - Scan Result

[!] Copy + Paste = NO FUD



Please any help? :(


RE: [FUD] Simple Method To Bypass AV [PowerShell] - learner319 - Oct 3, 2019

you are the great .Love you brother <3


RE: [FUD] Simple Method To Bypass AV [PowerShell] - and77 - Oct 4, 2019

Thank you, good luck in the future


RE: [FUD] Simple Method To Bypass AV [PowerShell] - twito - Oct 4, 2019

How to make cmd completely hidden way , it shows cmd for about 3 seconds


RE: [FUD] Simple Method To Bypass AV [PowerShell] - bexpr9 - Oct 8, 2019

thank you.
I'll enjoy with this.
You are a good person who gives convenience to many peoples.


RE: [FUD] Simple Method To Bypass AV [PowerShell] - Dorothy Gonzales - Oct 8, 2019

not very effective actually because it wont get past AMSI. also using base64 not very stealth at all...stands out like a pineapple because why would anything legit be doing something like this?

if you want to truly be FUD then make it look legit not stand out like something that is obviously shady


RE: [FUD] Simple Method To Bypass AV [PowerShell] - One - Oct 11, 2019

Lol when it comes to powershell and base64 all you need is to make the file scantime fud,I will keep saying this till someone gets it


RE: [FUD] Simple Method To Bypass AV [PowerShell] - Tyr - Jan 17, 2020

(Oct 11, 2019 02:52 PM)One Wrote:  Lol when it comes to powershell and base64 all you need is to make the file scantime fud,I will keep saying this till someone gets it

THANK YOU. I was reading the replies and laughing, lol.

@OP. Good thread and you put some nice work into it. Highly appreciated.

(Oct 4, 2019 08:40 AM)twito Wrote:  How to make cmd completely hidden way , it shows cmd for about 3 seconds

What OS are you testing this on, or are you Sandboxie-ing it? This is normal with certain stubs but can be fixed. 3 seconds is a little long though...


RE: [FUD] Simple Method To Bypass AV [PowerShell] - 4chan.org/b/ - Jan 17, 2020

its just going to get detected upon runtime lol.