+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Malware and Viruses (https://hackforums.net/forumdisplay.php?fid=287)
+---- Thread: What should be first? Loader / Stager / Dropper (/showthread.php?tid=6267227)
What should be first? Loader / Stager / Dropper - DustyDog123 - Mar 30, 2024
Hey,
I've been reading loads of posts on this forum and cannot figure out the type of malware I should be spreading in the first instance.
What is everyone else's choice and opinion on this?
RE: What should be first? Loader / Stager / Dropper - Raven™ - Mar 30, 2024
(Mar 30, 2024 12:23 PM)DustyDog123 Wrote: Hey,
I've been reading loads of posts on this forum and cannot figure out the type of malware I should be spreading in the first instance.
What is everyone else's choice and opinion on this?
Start with NJRat variants. The best i recommend to any new comers.
RE: What should be first? Loader / Stager / Dropper - DustyDog123 - Mar 30, 2024
(Mar 30, 2024 02:20 PM)Raven™ Wrote: Start with NJRat variants. The best i recommend to any new comers.
I think you've misinterpreted what I asked.
RE: What should be first? Loader / Stager / Dropper - Raven™ - Mar 30, 2024
(Mar 30, 2024 02:22 PM)DustyDog123 Wrote: I think you've misinterpreted what I asked.
Good catch! Ok, so start with Loader.
RE: What should be first? Loader / Stager / Dropper - DustyDog123 - Mar 30, 2024
(Mar 30, 2024 02:25 PM)Raven™ Wrote: Good catch! Ok, so start with Loader.
Thanks, that is what I thought.
But what is the point of a stager?
RE: What should be first? Loader / Stager / Dropper - Raven™ - Mar 30, 2024
(Mar 30, 2024 02:26 PM)DustyDog123 Wrote: Thanks, that is what I thought.
But what is the point of a stager?
A fileless malware used in multistage cyberattacks. This requires more complex form of planning.
RE: What should be first? Loader / Stager / Dropper - Hollows - Mar 31, 2024
You can start off with just an un-signed loader (built as WinPE .exe format) that loads your mutated modules into memory safely and go from there, this is the setup that I see most following when starting off. Any loader should be responsible for verifying the integrity of the system, maintain a secure channel of communication with your C&C and load modules (ideally into memory) if needed.
Don't complicate things in the start with a multi-stage payload, good luck.