(Dec 18, 2023 04:05 AM)0x0SH3 Wrote:  I developed my first crypter that has process hollowing as execution method, I use it for xmrig execution but I don't know if it's enough to evade av. I use a modded version of xmrig without dev fees so it has 3-4 less detections than the official xmrig (around 25 av detect it) but it's not blocked by windows defender.
- Do you know if I'll have runtime problems with antivirus solutions (the crypter runpe is near fud, I'm not sure about xmrig when it's running in memory)?
- xmrig.exe will be executed in RAM as child process of svchost.exe but maybe some antivirus are able to stop it by process name or I don't know how?

(Dec 18, 2023 04:09 AM)osn64698 Wrote:  Process hollowing in it's natural form is a method from 2006. Without adapting it properly you will be instantly detected.

(Dec 18, 2023 04:39 AM)0x0SH3 Wrote:  It's scantime 100% fud, I'm not sure how to check runtime with multiple antivirus without configuring too much vm. Do you know a service with "don't distribute" for runtime checking?

(Dec 18, 2023 04:38 AM)Tentco Wrote:  Buddy, you're using RunPE, stop it.

(Dec 18, 2023 04:41 AM)0x0SH3 Wrote:  what methods should I use?

(Dec 18, 2023 04:46 AM)Tentco Wrote:  You're dumb, the fact that you're saving non-encrypted raw bytes for your payload is just plain stupid, consider learning red teaming first.
Any method you will employ will need heavy modification.

(Dec 18, 2023 05:55 AM)0x0SH3 Wrote:  what? my crypter works fully in memory, it doesn't drop anything in the disk and the payload is decrypted in memory before execution, I don't know why you assume bytes are non-encrypted just by reading "hollowing" or "runpe" that are only execution methods, they have nothing to do with what was done at payload before execution..

(Dec 18, 2023 06:57 AM)Tentco Wrote:  When did I said it drops anything to disk? you don't know anything stop wasting my time.

(Dec 18, 2023 04:41 AM)0x0SH3 Wrote:  what methods should I use?

(Dec 18, 2023 08:52 AM)osn64698 Wrote:  You seem to think there is a "magic" method that works for every AV. It doesn't work this way. Don't buy this "priceless" BS.

Here is an actual suggestion: Go study reverse engineering, open a debugger, figure out why your shit gets caught, what triggers an AV detection runtime? What are you executing? Are you creating a new thread? Are you suspending one? are you writing your pages within MEM_IMAGE?

You are trying to achieve something without understanding how it works, do you know what NtMapViewOfSection does? Behind the scenes? what about NtUnmapViewOfSection? If not, you have no reason to use RUNPE, go back to basics.

Study the windows PE loader, then ask yourself how you can add your own customization. There is no NEED to call any WINAPI in order to load a basic PE file.

The only reason people still use "RunPE" is because they can copy & paste it. Takes 0 brain cells. It is 2023, you can use your brain to not use a 2006 method.

(Dec 18, 2023 08:52 AM)osn64698 Wrote:  You are trying to achieve something without understanding how it works, do you know what NtMapViewOfSection does? Behind the scenes? what about NtUnmapViewOfSection? If not, you have no reason to use RUNPE, go back to basics.

(Dec 18, 2023 04:05 AM)0x0SH3 Wrote:  blocked by windows defender.

(Dec 18, 2023 08:52 AM)osn64698 Wrote:  You seem to think there is a "magic" method that works for every AV. It doesn't work this way. Don't buy this "priceless" BS.

Here is an actual suggestion: Go study reverse engineering, open a debugger, figure out why your shit gets caught, what triggers an AV detection runtime? What are you executing? Are you creating a new thread? Are you suspending one? are you writing your pages within MEM_IMAGE?

You are trying to achieve something without understanding how it works, do you know what NtMapViewOfSection does? Behind the scenes? what about NtUnmapViewOfSection? If not, you have no reason to use RUNPE, go back to basics.

Study the windows PE loader, then ask yourself how you can add your own customization. There is no NEED to call any WINAPI in order to load a basic PE file.

The only reason people still use "RunPE" is because they can copy & paste it. Takes 0 brain cells. It is 2023, you can use your brain to not use a 2006 method.