(Nov 22, 2024 01:01 PM)aerohacker Wrote:  Which Crypter here has both features?! The most has Hidden Startup but not Hidden Process, I need both features to make the server invisible from Windows and thirdy-party tools.

(Nov 22, 2024 02:24 PM)DramaKing Wrote:  I have no ide what Hidden Startup is, but process hiding requires a ring 3 kernel rootkit. You will need privilege escalation for this.

(Nov 22, 2024 08:00 PM)aerohacker Wrote:  Hidden Startup will run the server invisible from startup options in msconfig and task manager.

(Nov 22, 2024 08:46 PM)DramaKing Wrote:  And hidden from the Startup menu? It's probably using a Run registry key, not startup.

(Nov 22, 2024 08:46 PM)DramaKing Wrote:  And hidden from the Startup menu? It's probably using a Run registry key, not startup.

(Nov 22, 2024 08:56 PM)aerohacker Wrote:  Or Task Scheduler.

---

I can add the server to task scheduler manually or make this automatically, using a Crypter with Hidden Startup feature to hide the server from startup folder, msconfig and task manager options.

And to hide the process, which Ring3 or Ring0 Rootkit do you recoomend?!

I know the in Github has a lot of cool projects, but I want something compiled, run the Rootkit and hide the process from task manager or another process managers tools.

The $77Rootkit works like that, but after install it and rename the server using the prefix $77 it's hide all related with the server (Which is very cool, it's my intention), but after that the server don't run too.

(Nov 23, 2024 05:03 AM)DramaKing Wrote:  You mean r77 rootkit. It's a common Ring 3 rootkit. Ring 0 rootkits have been practically unheard of since at least Windows Vista. Drivers need to be signed by EV certificates to run in kernel mode. These certificates can be revoked at any time by Microsoft. https://www.bleepingcomputer.com/news/security/new-windows-driver-signature-bypass-allows-kernel-rootkit-installs/

(Nov 23, 2024 12:16 PM)m0hx Wrote:  If I remember hidden process was possible in windows 7 and below. Not sure if there’s any now :/ mayb private ones but I haven’t seen any recently.

(Nov 23, 2024 02:25 PM)aerohacker Wrote:  Yeah, the r77 rootkit is what I found, compiled with the injector and etc, simple and works well, but the "problem" is, after install the r77 rootkit and rename the server using to $77server (example), everything related with the file disapear (Which is the function of the rootkit, but the same don't run too just be invisible).

There's a way to use r77 rootkit buy only to hide the process server?!

---

It's possible to hide process in new Windows versions too.

(Nov 23, 2024 04:45 PM)DramaKing Wrote:  Aren't you trying to hide the client? Why hide the C2 server?

---

Open a GitHub issue. I don't know the code to be able to answer.

(Nov 23, 2024 06:13 PM)aerohacker Wrote:  Not the RAT client, but I want to hide the RAT server process.

Example:

I use a lot of RATs both: Native and .NET, and after install the server on Windows, I like to do the server as hidden possible from user and even computer tech, so I always make:

- Hidden Installation - Install the server on Roaming/AppData and use attrib +h +s
- Hidden Startup - Install the server on Task Scheduler and make invisible from Startup Folder and Startup tab/programs on MSConfig and Task Manager
- Hidden Process - Hide the process server from Task Manager, Process Explorer, Process Hacker

Using r77 Rootkit the program hide everything what is very cool, but for some reason the server does becomes functional after being invisible, so that a way to use r77 rootkit but only for hide the process and not then server itself or another compiled Rootkit to do that?!

Or a free or paid Crypter with custom install, hidden startup and hidden process features to make all this things automatically?!

(Nov 23, 2024 08:14 PM)DramaKing Wrote:  Install the server on the victim PC? I'm too confused at this point, except to suggest a fileless crypter, nothing to hide then.

(Nov 24, 2024 12:13 PM)aerohacker Wrote:  What I says is when I install a server on PC user physically or remotelly, I like to make the servers most hidden as possible from user.

(Nov 24, 2024 01:45 PM)DramaKing Wrote:  So what do you run the client or payload on? Your PC?