Hack Forums
Moon Crypter [FUD 5+ MONTHS] VT PROOF | EXTENSION SPOOFING - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Marketplace (https://hackforums.net/forumdisplay.php?fid=105)
+--- Forum: Premium (https://hackforums.net/forumdisplay.php?fid=451)
+---- Forum: Cryptography and Encryption Market (https://hackforums.net/forumdisplay.php?fid=299)
+---- Thread: Moon Crypter [FUD 5+ MONTHS] VT PROOF | EXTENSION SPOOFING (/showthread.php?tid=6213537)

Pages: Pages 1 2

Moon Crypter [FUD 5+ MONTHS] VT PROOF | EXTENSION SPOOFING - Moon_Developer - Jul 15, 2022

[Image: moon_banner.gif]
[Image: Moon_crypter.gif]
[Image: Moon_crypter_1.gif]





BSOD ( if closed )
WATCHDOG
Check IsDebuggerPresent (Anti Debug / Attach )
Check MouseMovements ( Close if user is a VM )
AES / XOR / Custom Encryption
Support .NET / Native / ASM / Python / Java ( x64 - x86 )
File is compressed and reduced of size (Max 300kb for 1/2mb file )
Destroy payload ( "Melt" )
Melt file (self delete)
Bind files ( ALL extensions. e.g mp4 / pdf / etc )
AMSI / EFW / AV evasion and hooking



VIRUSTOTAL LINK - > https://www.virustotal.com/gui/file/cbc988436005a79d12c786a4483c78f91a72eb22b59c03c289f63053eb21d598/details

**Also single crypt available for PUBLIC stub ( 25$ for crypt.)

Telegram @LordCokage

PROVIDING  2 VOUCH COPIES TOO ( ONLY TO USERS THAT ARE REGISTERED FROM MORE THEN 5+ years or with 100+ contracts!

We are using an extension spoofing (forced to .batch )
The "mechanism" is exactly this :
- > Batch file - > Powershell (RunPE) -> Decrypt* - > c++ stub - > Decrypt - > Execute  (public stub is c++, private stub is c++ with mASM, low size )
[contract=tid]Start Contract[/contract]

Paid Sticky Post - Sticky Bot - Jul 15, 2022

Hi, I'm Sticky Bot. The owner of this thread has purchased a Paid Sticky. Hack Forums does not get involved in deals or deal disputes. We do not vouch for the product or the service offered by members. Please note that all deals are at your own risk. The sticky will expire on 07-22-2022. If you or a loved one are interested in buying a sticky please visit this page: Buy Sticky. For more information about Paid Stickies you can read our Help Doc.

RE: Moon Crypter [FUD 5+ MONTHS] VT PROOF | EXTENSION SPOOFING - SIM-3281006 - Jul 16, 2022

I need to check out this...

RE: Moon Crypter [FUD 5+ MONTHS] VT PROOF | EXTENSION SPOOFING - hamin390724 - Jul 16, 2022

I bought this seller's product. (public / 1 month)
Since there are few reviews for this seller, I will kindly write a review for other users of HF.

I have completed the payment and am waiting for the delivery of the product.(Delivery scheduled within 24 hours)
After receiving the crypter, I will focus on bypassing AV on runtime and whether it works well.

RE: Moon Crypter [FUD 5+ MONTHS] VT PROOF | EXTENSION SPOOFING - localhost247 - Jul 18, 2022

Did you think is a good idea to make the file in .batch after crypting.
because it will be easy to decrypt.

Please can anyone confirm if it bypass WD.

RE: Moon Crypter [FUD 5+ MONTHS] VT PROOF | EXTENSION SPOOFING - Moon_Developer - Jul 18, 2022

(Jul 18, 2022 06:19 AM)localhost247 Wrote:  how much did you paid for it?

Hi, do you mean prices? Read post again

RE: Moon Crypter [FUD 5+ MONTHS] VT PROOF | EXTENSION SPOOFING - Moon_Developer - Jul 20, 2022

(Jul 18, 2022 06:19 AM)localhost247 Wrote:  Did you think is a good idea to make the file in .batch after crypting.
because it will be easy to decrypt.

Please can anyone confirm if it bypass WD.

The main goal of crypting with this method, is that isn't easy for them to recognize file as .executable on scantime, and while for runtime
it decrypt and allocate memory dynamically , so , it's not easy to decrypt, or to detect!

Check it out video, and uploaded VT link for scan!

RE: Moon Crypter [FUD 5+ MONTHS] VT PROOF | EXTENSION SPOOFING - Moon_Developer - Jul 20, 2022

(Jul 20, 2022 02:21 AM)kysse Wrote:  refused to provide a vouch copy because he posted "proof/virus total links" on the thread.

Uploading to virus total eventually will get this method patched.

I'm not forced to give a vouch copy, you can read again the rules. Also, it's safe from the first time I posted it here , also uploading new links,
and due to this method of extension spoofing used, it won't get detected anytime soon

And i've already sold product here ( and as my other thread , all are liked by users. )

----

Also, after begging for a vouch ( while you got also open disputes. ) it's not really a trustworthy thing.
You are probably the last person that ( noone here ) will give a vouch copy too

go away and stop trying to shitpost :)

RE: Moon Crypter [FUD 5+ MONTHS] VT PROOF | EXTENSION SPOOFING - dublib - Jul 20, 2022

(Jul 20, 2022 02:25 AM)Moon_Developer Wrote:  I'm not forced to give a vouch copy, you can read again the rules. Also, it's safe from the first time I posted it here , also uploading new links,
and due to this method of extension spoofing used, it won't get detected anytime soon

Thanks

eh that's funny it's like you didn't upload to virustotal where they distribute to all AVs
same guy @elmundo sold the same thing and it was detected week after

RE: Moon Crypter [FUD 5+ MONTHS] VT PROOF | EXTENSION SPOOFING - Avi- - Jul 20, 2022

(Jul 20, 2022 02:25 AM)Moon_Developer Wrote:  I'm not forced to give a vouch copy, you can read again the rules. Also, it's safe from the first time I posted it here , also uploading new links,
and due to this method of extension spoofing used, it won't get detected anytime soon

And i've already sold product here ( and as my other thread , all are liked by users. )

----

Also, after begging for a vouch ( while you got also open disputes. ) it's not really a trustworthy thing.
You are probably the last person that ( noone here ) will give a vouch copy too

go away and stop trying to shitpost :)

looks like his open dispute is resolved on his end and the other guy is just offline to mark it as resolve lol and it's a dispute over him leaving a negative b-rating on his service + you prob shouldn't offer vouch copies on the post and not want to provide them to members who are 5+ years onsite and like he mentioned uploading to virustotal, this will just end up being patched.

RE: Moon Crypter [FUD 5+ MONTHS] VT PROOF | EXTENSION SPOOFING - Moon_Developer - Jul 20, 2022

(Jul 20, 2022 02:58 AM)Avi- Wrote:  looks like his open dispute is resolved on his end and the other guy is just offline to mark it as resolve lol and it's a dispute over him leaving a negative b-rating on his service + you prob shouldn't offer vouch copies on the post and not want to provide them to members who are 5+ years onsite and like he mentioned uploading to virustotal, this will just end up being patched.

Its not gonna get patched, if it Was the case, it should have been time ago, and not after 5 months, also I have my own methods to keep updating it

1 month : 40$ public stub 
3 month : 100$ public stub 

1 month : 80$ private stub

^^^^^^^^ Updated Price for next 3 customers

BUMP - Stanley - Jul 24, 2022

I'm Stanley HF's helper bot. The OP (original poster) of this thread wants everyone to see this page and has elected to bump it to the top of the showthread listing. Since HF doesn't want a ton of LQP (Low Quality Posts) this is the best method of bumping your content. There is a small βyte fee for each bump. Any OP can bump any of their threads on HF from the linked icon on the top of their first post.

If you haven't already read the first post of this thread we encourage you to do so.

Thanks,
Stanley

RE: Moon Crypter [FUD 5+ MONTHS] VT PROOF | EXTENSION SPOOFING - Moon_Developer - Aug 7, 2022

20% discount on all sales till 10/08

RE: Moon Crypter [FUD 5+ MONTHS] VT PROOF | EXTENSION SPOOFING - wtfpop - Aug 17, 2022

You know, i'd appreciate it if you stopped pasting my stuff.
Anyways, my github got suspended so good luck finding someone else to paste from if you feel like scamming more people.

RE: Moon Crypter [FUD 5+ MONTHS] VT PROOF | EXTENSION SPOOFING - justalemon - Aug 17, 2022

Virus total shows Microsoft Defender detection "VirTool:BAT/Ialive.E!MTB". Is that correct? Btw, this is exe output or .bat?