+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Cryptography, Encryption, and Decryption (https://hackforums.net/forumdisplay.php?fid=126)
+---- Thread: Windows Defender bypass (/showthread.php?tid=6289272)
Pages: Pages
1
2
Windows Defender bypass - _SyncX404 - Jan 9, 2025
Hello, I'm looking for crypter that would be able to bypass windows defender.
I'm using BitRat and it get detected by windows defender easily.
Also, even if I run BitRat as administrator (on VM) it doesn't add itself as exclusion to windows defender, so after PC restart it get's removed.
The only way it stays on was when I manually added it to windows defender exclusion. It's injected in System32 i think (not sure tho) so it requires
restart for removal. But yeah, I want it to stay even after restarts.
RE: Windows Defender bypass - DramaKing - Jan 10, 2025
(Jan 9, 2025 11:47 PM)_SyncX404 Wrote: Hello, I'm looking for crypter that would be able to bypass windows defender.
I'm using BitRat and it get detected by windows defender easily.
Also, even if I run BitRat as administrator (on VM) it doesn't add itself as exclusion to windows defender, so after PC restart it get's removed.
The only way it stays on was when I manually added it to windows defender exclusion. It's injected in System32 i think (not sure tho) so it requires
restart for removal. But yeah, I want it to stay even after restarts.
Have you thought of using a dropper?
RE: Windows Defender bypass - _SyncX404 - Jan 10, 2025
(Jan 10, 2025 04:54 AM)DramaKing Wrote: Have you thought of using a dropper?
Dropper? What exactly is that? Is that a name of encrypter or something?
RE: Windows Defender bypass - Horus_Protector - Jan 10, 2025
Hello, I invite you to try my crypter, I give you a sample as a test
RE: Windows Defender bypass - _SyncX404 - Jan 10, 2025
(Jan 10, 2025 11:10 AM)Horus_Protector Wrote: Hello, I invite you to try my crypter, I give you a sample as a test
Hmmm, sure slide me a pm
RE: Windows Defender bypass - Tyr - Jan 10, 2025
(Jan 9, 2025 11:47 PM)_SyncX404 Wrote: Hello, I'm looking for crypter that would be able to bypass windows defender.
I'm using BitRat and it get detected by windows defender easily.
Also, even if I run BitRat as administrator (on VM) it doesn't add itself as exclusion to windows defender, so after PC restart it get's removed.
The only way it stays on was when I manually added it to windows defender exclusion. It's injected in System32 i think (not sure tho) so it requires
restart for removal. But yeah, I want it to stay even after restarts.
Let me know if you're looking for something a little more advanced than basic cryptography and if your spreading method can be paired with steganography.
RE: Windows Defender bypass - _SyncX404 - Jan 10, 2025
(Jan 10, 2025 11:17 AM)Tyr Wrote: Let me know if you're looking for something a little more advanced than basic cryptography and if your spreading method can be paired with steganography.
Hi, can I ask what’s the difference between a normal encyption and steganography
RE: Windows Defender bypass - Tyr - Jan 10, 2025
(Jan 10, 2025 11:19 AM)_SyncX404 Wrote: Hi, can I ask what’s the difference between a normal encyption and steganography
Huge difference. Steg is when you hide a hidden message and/or communicate some form of idea, concept, or communication that is hidden via the picture with embedded data within a picture. For instance, steganography works with pixels by subtly altering their color values to encode hidden information. This is often done in ways that are imperceptible to the human eye. There are many different types of steg but for your purposes you would use file system steg in order to maintain persistence via your stub. This is more-so of a spreading method though. Encryption on the other hand is complex process that involves scrambling of relevant content. For instance, in this scenario, the encrypted message is obvious to anyone who intercepts it, though its content is incomprehensible without the decryption key. This same concept can also be applied to steg. Once you understand the intriacies you can put a spin on it in order to trick windows defender by obfuscating your stub and accompanying files that may incidentally set off windows defender.
RE: Windows Defender bypass - _SyncX404 - Jan 10, 2025
(Jan 10, 2025 11:30 AM)Tyr Wrote: Huge difference. Steg is when you hide a hidden message and/or communicate some form of idea, concept, or communication that is hidden via the picture with embedded data within a picture. For instance, steganography works with pixels by subtly altering their color values to encode hidden information. This is often done in ways that are imperceptible to the human eye. There are many different types of steg but for your purposes you would use file system steg in order to maintain persistence via your stub. This is more-so of a spreading method though. Encryption on the other hand is complex process that involves scrambling of relevant content. For instance, in this scenario, the encrypted message is obvious to anyone who intercepts it, though its content is incomprehensible without the decryption key. This same concept can also be applied to steg. Once you understand the intriacies you can put a spin on it in order to trick windows defender by obfuscating your stub and accompanying files that may incidentally set off windows defender.
Damn, but how much would that cost? the steganography
RE: Windows Defender bypass - Horus_Protector - Jan 10, 2025
(Jan 10, 2025 11:16 AM)_SyncX404 Wrote: Hmmm, sure slide me a pm
I can't send you a private message, I don't have enough coins, here is my Telegram: [deleted]
RE: Windows Defender bypass - latencyx - Jan 15, 2025
Beware of sellers who promise magic...
RE: Windows Defender bypass - Horus_Protector - Jan 15, 2025
(Jan 10, 2025 11:16 AM)_SyncX404 Wrote: Hmmm, sure slide me a pm
Up
RE: Windows Defender bypass - _SyncX404 - Jan 16, 2025
(Jan 15, 2025 05:14 PM)latencyx Wrote: Beware of sellers who promise magic...
I will, thanks. I mean I won’t buy anything from people that don’t have good repultation here on HF :)
RE: Windows Defender bypass - DramaKing - Jan 17, 2025
(Jan 10, 2025 06:20 AM)_SyncX404 Wrote: Dropper? What exactly is that? Is that a name of encrypter or something?
See here: https://chatgpt.com/share/678ae08b-a3a8-8001-9cf7-56bc8d37048c.
RE: Windows Defender bypass - _SyncX404 - Jan 18, 2025
(Jan 17, 2025 04:03 PM)DramaKing Wrote: See here: https://chatgpt.com/share/678ae08b-a3a8-8001-9cf7-56bc8d37048c.
Thanks