+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Cryptography, Encryption, and Decryption (https://hackforums.net/forumdisplay.php?fid=126)
+---- Thread: <<<< Easy >>>> How to bypass Windows Defender for beginner in 5min (/showthread.php?tid=6057011)
Pages: Pages
1
2
<<<< Easy >>>> How to bypass Windows Defender for beginner in 5min - NYANxCAT - Mar 14, 2020
You all have a problem with WD, I created this video to show you how to bypass WD+Internet easily using open-source runPE class even if you are a beginner!
I also used the browser to download the payload into the WD machine instead of just copy+paste it from VM to another just to simulate the real scenario.
This method will work on .NET or Native files. I did my best to make this tutorial as simple as possible(just 1 class, no external lib, no encryption..etc).
And again.. copy+paste this tutorial won't give you a FUD result, Take the idea and be creative.
Enjoy watching.
Scantime (Click to View)
![[Image: Uj1ffcv.png]](https://i.imgur.com/Uj1ffcv.png)
RE: <<<< Easy >>>> How to bypass Windows Defender for beginner in 5min - kausar0707 - Mar 14, 2020
Thanks for sharing dude :)
RE: <<<< Easy >>>> How to bypass Windows Defender for beginner in 5min - Aekras1a - Mar 14, 2020
Awesome guide, thank you NYAN, and congratulations on getting married ^^
RE: <<<< Easy >>>> How to bypass Windows Defender for beginner in 5min - 1stetcgoldmedal - Mar 14, 2020
I respect the spirit of sharing
A great friend for beginners
RE: <<<< Easy >>>> How to bypass Windows Defender for beginner in 5min - Mirakuru - Mar 15, 2020
Thank you for share mate. :)
RE: <<<< Easy >>>> How to bypass Windows Defender for beginner in 5min - Kindness - Mar 15, 2020
Very informative and useful tutorial.Thank you so much brother.
Congratulations on getting married.May Allah bless you brother <3
RE: <<<< Easy >>>> How to bypass Windows Defender for beginner in 5min - stringsnstuff - Mar 15, 2020
Hello thank you very much Nyan, I have implemented this into my personal runtime/scantime crypter coded in C and it helped for sure. I saw you defined a string for path and a string for decrypting Base64. Do you actually use the Base64 string or do you only have it defined and that's it?
RE: <<<< Easy >>>> How to bypass Windows Defender for beginner in 5min - NYANxCAT - Mar 15, 2020
(Mar 15, 2020 12:23 PM)stringsnstuff Wrote: Hello thank you very much Nyan, I have implemented this into my personal runtime/scantime crypter coded in C and it helped for sure. I saw you defined a string for path and a string for decrypting Base64. Do you actually use the Base64 string or do you only have it defined and that's it?
hello, yes I used it by converting the string to byte array.
RE: <<<< Easy >>>> How to bypass Windows Defender for beginner in 5min - stringsnstuff - Mar 15, 2020
(Mar 15, 2020 12:53 PM)˗ˏˋ NYAN CAT ˎˊ˗ Wrote: hello, yes I used it by converting the string to byte array.Alright sorry for not being clear enough. My question was what did you do with the byte array? I only see the byte array being defined I don't see you using it anywhere.
RE: <<<< Easy >>>> How to bypass Windows Defender for beginner in 5min - Irrelewanted - Mar 16, 2020
(Mar 15, 2020 01:11 PM)stringsnstuff Wrote: Alright sorry for not being clear enough. My question was what did you do with the byte array? I only see the byte array being defined I don't see you using it anywhere.
Correct me if I'm wrong Nyan, but he executed the "byte array" which was the binary of the RAT (stub) itself.
How he executes the byte array, is a whole and really advanced other story. Look up "process hollowing" on Google for more information on how "RunPE" executes it's code into a newly suspended process.
Great video though. Quick, simple and functioning.
RE: <<<< Easy >>>> How to bypass Windows Defender for beginner in 5min - stringsnstuff - Mar 16, 2020
(Mar 16, 2020 04:23 PM)Irrelewanted Wrote: Correct me if I'm wrong Nyan, but he executed the "byte array" which was the binary of the RAT (stub) itself.
How he executes the byte array, is a whole and really advanced other story. Look up "process hollowing" on Google for more information on how "RunPE" executes it's code into a newly suspended process.
Great video though. Quick, simple and functioning.
Yeah I know how RunPE works. I know whats going on. He is using the byte array to execute the server. Was confused at first. Thank you for your reply. Was confused because I'm not familiar with this coding language as I am a c++ programmer.
RE: <<<< Easy >>>> How to bypass Windows Defender for beginner in 5min - Irrelewanted - Mar 16, 2020
(Mar 16, 2020 04:27 PM)stringsnstuff Wrote: Yeah I know how RunPE works. I know whats going on. He is using the byte array to execute the server. Was confused at first. Thank you for your reply.
No problem, I'm glad that I cleared that up for you.
RE: <<<< Easy >>>> How to bypass Windows Defender for beginner in 5min - Obistone - Mar 16, 2020
(Mar 16, 2020 04:27 PM)stringsnstuff Wrote: Was confused because I'm not familiar with this coding language as I am a c++ programmer.
You should be a little bit familiar with C# as it is in the C family, just like C++.
RE: <<<< Easy >>>> How to bypass Windows Defender for beginner in 5min - RedirectMe - Mar 17, 2020
C# is not like C++ or C. It's more like Java
RE: <<<< Easy >>>> How to bypass Windows Defender for beginner in 5min - kiffu - Mar 28, 2020
Thanks for sharing, i tried but WD is detecting, i am not worried about other AVs but i just want to bypass WD, please pm me if you can help and let me know what changes if i do will help me bypass WD.
Thank You