+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Cryptography, Encryption, and Decryption (https://hackforums.net/forumdisplay.php?fid=126)
+---- Thread: Best Persistence Technique? (/showthread.php?tid=6258443)
Best Persistence Technique? - Neik111 - Dec 12, 2023
Hey Guys,
I have a problem with startup of my exe.
Its completly fud, but when i use a reg key for startup it gets detected.
Startupfolder also gets detected.
How can i avoid this or use another technique?
RE: Best Persistence Technique? - osn64698 - Dec 12, 2023
Nobody will share his own method, but you can start by using .bat/.vbs files etc.
RE: Best Persistence Technique? - DramaKing - Dec 13, 2023
Need to know the AV in question. These are legitimate ways to run apps at startup, so it's hard to say.
RE: Best Persistence Technique? - gangushbo - Dec 13, 2023
which av? watchdog tried?
RE: Best Persistence Technique? - neonbytes - Dec 14, 2023
maybe you can use an intermediate lolbin to create it for your malware
trojan > lolbin > create reg key
this could detatch the action from your malware
RE: Best Persistence Technique? - Neik111 - Dec 14, 2023
(Dec 14, 2023 05:13 PM)neonbytes Wrote: maybe you can use an intermediate lolbin to create it for your malware
trojan > lolbin > create reg key
this could detatch the action from your malware
Yea i tried this, setting the key is undetected, just when you reboot, then its detected
RE: Best Persistence Technique? - Wacatac - Dec 14, 2023
(Dec 14, 2023 08:57 PM)Neik111 Wrote: Yea i tried this, setting the key is undetected, just when you reboot, then its detected
Because your malware that you're trying to put on startup is detected, not the LOLBIN.
RE: Best Persistence Technique? - NyQuil - Dec 23, 2023
(Dec 14, 2023 09:46 PM)Tentco Wrote: Because your malware that you're trying to put on startup is detected, not the LOLBIN.
run as admin, kek
RE: Best Persistence Technique? - DramaKing - Dec 23, 2023
Not to beat a dead horse, but based on the available info, it may not be completely FUD. It could be detected at runtime without the execution method having anything to do with it. Or the registry key could push the heuristics just enough to trigger detection. Maybe try creating a scheduled task.