+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Cryptography, Encryption, and Decryption (https://hackforums.net/forumdisplay.php?fid=126)
+---- Thread: [Development Thread] PsiProtector - Polymorphic C# Crypter (/showthread.php?tid=6081768)
[Development Thread] PsiProtector - Polymorphic C# Crypter - PsiSolutions - May 25, 2020
Hello everyone,
I have decided to start a thread following the development of my new, coded from scratch polymorphic crypter in C#. I will be detailing every step of my process of development of the crypter, until it is eventually fully functioning and released for sale (or abandoned lol). I am doing this to get people interested in this project, as well as to maybe help somebody out in the process of software development. I am no expert by any means, but I have been coding for 10 years and I feel like this is a project I can handle. If you have any questions or comments feel free to post them! Thank you
Images:
https://imgur.com/a/zTx9ESk
Planned Features:
- Unique stub generation
- Polymorphic method utilization
- Anti-virtualization
- Anti-Sandbox
- Anti-VMWare
- Anti-VirtualPC
- Anti-Sandbox
- Execution
- Custom delay
- Don't run until restart
- Delete original file (file melt)
- Custom delay
- RunPE/LoadPE
- Native/.NET Support
- File Properties
- Startup
- Spoof Extension
- Clone Icon/Assembly Info
- Change file size
- Bind to another file
- Startup
- Process persistence
- File persistence
- Startup persistence
- Silent UAC elevation
- Bypass 1909 WD (hopefully) (and other AVs)
- 5 Algorithms Planned
- AES
- XOR
- Blowfish
- Triple DES
- RSA
- AES
Current progress(5/25):
Quote:Completed UI design and controls
Added functionality to all UI elements (file load, assembly information grabber, expected file size calculation)
Implemented custom licensing system
Setup C# CodeDom compiler
Implemented basic USG system (can generate unique .exes with specified code)
More to come! I plan to be developing daily, but I will be starting work back again so it may go slow for a while. Hope you enjoy and let me know what you think!
RE: [Development Thread] PsiProtector - Polymorphic C# Crypter - axel87 - May 26, 2020
a great job, congratulations
RE: [Development Thread] PsiProtector - Polymorphic C# Crypter - VisualSoft - May 26, 2020
Good Job on this, Just make sure you bypass all AV on runtime as well as scantime.
RE: [Development Thread] PsiProtector - Polymorphic C# Crypter - Jean-Jacques Rousseau - May 26, 2020
Polymorphic executables don’t work in the malware game. Any unknown executable, even not malicous, will be heur/ml detected. Even if you’re not detected, the behavioural engine is tuned against your unknown file.
RE: [Development Thread] PsiProtector - Polymorphic C# Crypter - PsiSolutions - May 26, 2020
(May 26, 2020 08:57 AM)Supercut Wrote: Polymorphic executables don’t work in the malware game. Any unknown executable, even not malicous, will be heur/ml detected. Even if you’re not detected, the behavioural engine is tuned against your unknown file.
Interesting, so all programs that make use of polymorphism get flagged as malicious? Or is it just easier to detect a program that is polymorphic in nature? I will try and see what I can do but I may scrap the polymorphism if it gives me problems.
Changelog 5/26
Quote:Implemented delay
Implemented extension spoofer
Implemented file assembly info generation
Implemented icon changer
RE: [Development Thread] PsiProtector - Polymorphic C# Crypter - VisualSoft - May 26, 2020
(May 26, 2020 08:57 AM)Supercut Wrote: Polymorphic executables don’t work in the malware game. Any unknown executable, even not malicous, will be heur/ml detected. Even if you’re not detected, the behavioural engine is tuned against your unknown file.
dude let the guy try out, eventually he will know.
RE: [Development Thread] PsiProtector - Polymorphic C# Crypter - Jean-Jacques Rousseau - May 26, 2020
(May 26, 2020 07:08 PM)PsiSolutions Wrote: Interesting, so all programs that make use of polymorphism get flagged as malicious? Or is it just easier to detect a program that is polymorphic in nature? I will try and see what I can do but I may scrap the polymorphism if it gives me problems.
Changelog 5/26
I used polymorphic LLVM passes before, they worked fine as long as you do the regular anti-heur/ml things on your exe. Using that I was capable of producing 96-98% unique stubs (the pass works on each basic block, inserts and replaces assembly instruction, please read the LLVM documentation if you want to know more).
The problem is that:
Heur/ml is NOT trained to detect malware
It is trained to detect goodware, and flags anything else.
It might work for you, however, I was working with polymorphism for some time, now I have changed method completely where the crypter is not even an exe file. Unknown executables are simply fucked by all engines.
All of this might be false for .NET though, but I would not code a crypter in .NET to begin with.
(May 26, 2020 07:13 PM)VisualSoft Wrote: dude let the guy try out, eventually he will know.
I am just trying to share my experience, I would love to see true polymorphic binaries in .NET.
RE: [Development Thread] PsiProtector - Polymorphic C# Crypter - SIM-3149568 - May 27, 2020
Looks very interesting but dude RSA is not used for data encryption in common case. RSA is used for private encryption tunnel like VPN, telegram private chats, etc. And silent UAC elevation.. I want to see this if this means uac bypass
RE: [Development Thread] PsiProtector - Polymorphic C# Crypter - VisualSoft - May 27, 2020
(May 27, 2020 12:01 AM)tree8069 Wrote: Looks very interesting but dude RSA is not used for data encryption in common case. RSA is used for private encryption tunnel like VPN, telegram private chats, etc. And silent UAC elevation.. I want to see this if this means uac bypass
you can find many uac bypass around, he is going to use one of those methods.
RE: [Development Thread] PsiProtector - Polymorphic C# Crypter - SIM-3149568 - May 27, 2020
(May 27, 2020 01:59 AM)VisualSoft Wrote: you can find many uac bypass around, he is going to use one of those methods.
Is there a method even working on latest windows like 1909 build? I've knew about uac bypass exploit using event viewer. But it is not working at all.
RE: [Development Thread] PsiProtector - Polymorphic C# Crypter - VisualSoft - May 27, 2020
(May 27, 2020 02:16 AM)SF Tree Wrote: Is there a method even working on latest windows like 1909 build? I've knew about uac bypass exploit using event viewer. But it is not working at all.
yes, there are some methods still working.
event viewer is old method and also its runtime detected.
RE: [Development Thread] PsiProtector - Polymorphic C# Crypter - PsiSolutions - May 27, 2020
(May 27, 2020 02:16 AM)SF Tree Wrote: Is there a method even working on latest windows like 1909 build? I've knew about uac bypass exploit using event viewer. But it is not working at all.
There are many exploits and methods for obtaining admin privileges and startup in 1909 publicly available, and I plan to utilize them based on operating system vulnerability. Whether or not these methods add detections is a different story. Being in the very early stages of development, a lot is still unknown to me and in the planning phase. Mostly I started this project to keep me busy in my spare time since I love to code and felt it would be a nice challenge, so in the end if it doesn't work out completely (considering the entire dynamics of the crypting world have changed since I was last active in malware) I won't be too dissapointed
RE: [Development Thread] PsiProtector - Polymorphic C# Crypter - danny34 - May 27, 2020
Good luck with your projects once you done polymorphic you should try metamorphic.
RE: [Development Thread] PsiProtector - Polymorphic C# Crypter - PsiSolutions - May 27, 2020
(May 27, 2020 11:38 AM)danny34 Wrote: Good luck with your projects once you done polymorphic you should try metamorphic.
No joke I was thinking of this this morning. Would be a fun thing to try and implement, I just think it will take a while to code
RE: [Development Thread] PsiProtector - Polymorphic C# Crypter - danny34 - May 27, 2020
For asm first thing is to recalculate intgers and defate static signature ex. push dword, mov reg32,dword etc.
With working metamorphic encoder will be
antiscan: 0/26
Vir*sT**al : 0/72
Then add anti emulation for client side and cloud.
Real world example:
Metasploit x86 payload:
add edi,[ebp-08h]
sub edi,05709C146h restore real hash dword
cmp edi,[ebp+024h]
jnz AErh
push blah
push blah
push blah
push 0B01CB606h new hash (dword old + random int)
call ebp