Crypter for Razor Rat - Printable Version

Crypter for Razor Rat - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Cryptography, Encryption, and Decryption (https://hackforums.net/forumdisplay.php?fid=126)
+---- Thread: Crypter for Razor Rat (/showthread.php?tid=6296486)

Crypter for Razor Rat - tyjesws - Apr 18, 2025

hello
i tried many crypters from the market and all were detected by either wd or smartscreen
a few posts on here recommended private crypts made by a forum user named Z***
i sent him a private message weeks ago but was never answered

does anyone know how i can reach him?
or do you know of a working crypting service that offers private stubs?

thanks

RE: Crypter for Razor Rat - Hopsin - Apr 18, 2025

(Apr 18, 2025 11:27 AM)tyjesws Wrote: hello
i tried many crypters from the market and all were detected by either wd or smartscreen
a few posts on here recommended private crypts made by a forum user named Z***
i sent him a private message weeks ago but was never answered

does anyone know how i can reach him?
or do you know of a working crypting service that offers private stubs?

thanks

What's his profile link or UID ? Also, what is your budget ?

RE: Crypter for Razor Rat - DramaKing - Apr 18, 2025

Python scripts are supposed to be invisible to antivirus.

RE: Crypter for Razor Rat - tyjesws - Apr 19, 2025

(Apr 18, 2025 11:27 AM)tyjesws Wrote: hello
i tried many crypters from the market and all were detected by either wd or smartscreen
a few posts on here recommended private crypts made by a forum user named Z***
i sent him a private message weeks ago but was never answered

does anyone know how i can reach him?
or do you know of a working crypting service that offers private stubs?

thanks

thanks for the reply
sent you a pm

(Apr 18, 2025 12:56 PM)Hopsin Wrote: What's his profile link or UID ? Also, what is your budget ?

thanks for the reply
but i dont see how its relevant
maybe i misunderstood
razor is written in c++ and asm

RE: Crypter for Razor Rat - Sand Ferret - Apr 20, 2025

You're unlikely to find any good crypting service on this forum - it's unfortunate, but that's the reality. That applies to all malware, not specifically Razor.

Razor is not hard to crypt, the problem that people face when trying to crypt it is they do not know how Razor works internally; Razor drops copies of itself during certain tasks, such as auto elevation and for startup - if that copy is not properly crypted, then the AV kills it. The majority of crypter coders on this site are too lazy to even bother testing the malware before agreeing to crypt.

RE: Crypter for Razor Rat - tyjesws - Apr 21, 2025

(Apr 20, 2025 11:45 PM)Sand Ferret Wrote: You're unlikely to find any good crypting service on this forum - it's unfortunate, but that's the reality. That applies to all malware, not specifically Razor.

Razor is not hard to crypt, the problem that people face when trying to crypt it is they do not know how Razor works internally; Razor drops copies of itself during certain tasks, such as auto elevation and for startup - if that copy is not properly crypted, then the AV kills it. The majority of crypter coders on this site are too lazy to even bother testing the malware before agreeing to crypt.

thanks for that
so do you know where i could find someone who properly crypts malware?
in the case of razor, maybe i could use its static output option and have the crypter take care of startup and elevation. usually the crypter is responsible for these functions anyhow, no?

RE: Crypter for Razor Rat - 7 - Apr 21, 2025

(Apr 20, 2025 11:45 PM)Sand Ferret Wrote: You're unlikely to find any good crypting service on this forum - it's unfortunate, but that's the reality. That applies to all malware, not specifically Razor.

Razor is not hard to crypt, the problem that people face when trying to crypt it is they do not know how Razor works internally; Razor drops copies of itself during certain tasks, such as auto elevation and for startup - if that copy is not properly crypted, then the AV kills it. The majority of crypter coders on this site are too lazy to even bother testing the malware before agreeing to crypt.

Same problem with amadey loader. It drops uncrypted dlls which instantly get detected.

Crypting is a very diffucult probelm to face these days due to hueristic scans anyway you can pay up to 5k for a crypt and still hit heuritic protection.
Ratting now is the final step in the attack not the initial payload like it once was.

I cannot really give tyjesws advice on crypting Razor Rat. Actually I have never seen it until today.
If you hoping to just mass spread and hope for the best result you will find a solution but you want 100% success, your starting off the wrong way.

RE: Crypter for Razor Rat - tyjesws - Apr 21, 2025

(Apr 21, 2025 01:38 AM)7 Wrote: Same problem with amadey loader. It drops uncrypted dlls which instantly get detected.

Crypting is a very diffucult probelm to face these days due to hueristic scans anyway you can pay up to 5k for a crypt and still hit heuritic protection.
Ratting now is the final step in the attack not the initial payload like it once was.

I cannot really give tyjesws advice on crypting Razor Rat. Actually I have never seen it until today.
If you hoping to just mass spread and hope for the best result you will find a solution but you want 100% success, your starting off the wrong way.

thanks, very eye-opening
what then is the initial payload for 100% success?
im not interested in mass spreading

RE: Crypter for Razor Rat - 7 - Apr 21, 2025

I would start with a c2 shell MSF or personally I prefer havoc and work on getting that passed AV's first.
It's a learning curve but you will soon start to catch on and also much more educational

RE: Crypter for Razor Rat - Yokobovich - May 5, 2025

I won't be mentioning the unmentionable (Z) for various reasons. 😆

But,

Through extensive use of Razor, I can reveal this:

1. The recent versions of Razor doesn't drop anything during auto elevation, likely a different UAC method.

2. Razor does NOT drop the bot in static mode or persistence-less mode. The static mode was explained to be a solution for those using the simpler Run-PE style crypters.

3. If a non-static bot (injecting) has persistence ENABLED, then the bot is dropped ONLY at the exact moment of system reboot and shutdowns. Never before or during execution.

4. If a non-static bot (injecting) has persistence DISABLED, then NO dropping is done, EVER.

My advice to people using the most primitive crypters: A good approach is to enable the static mode because such bots can run from anywhere without any extra noise. If persistence is needed, just enable it in the crypter.

Or you can use the unmentionables crypter stubs if you have rich parents and don't mind being yelled at. 😆😆😆