Hack Forums
SKYNETCRYPTER.VIP | UNIQUE&PRIVATE | AV/EDR KILLER | EXPLOITS .XLL .XLS .INK .DOCX | - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Marketplace (https://hackforums.net/forumdisplay.php?fid=105)
+--- Forum: Auxiliary (https://hackforums.net/forumdisplay.php?fid=453)
+---- Forum: Member Sales Market (https://hackforums.net/forumdisplay.php?fid=176)
+---- Thread: SKYNETCRYPTER.VIP | UNIQUE&PRIVATE | AV/EDR KILLER | EXPLOITS .XLL .XLS .INK .DOCX | (/showthread.php?tid=6296739)

Pages: Pages 1 2

SKYNETCRYPTER.VIP | UNIQUE&PRIVATE | AV/EDR KILLER | EXPLOITS .XLL .XLS .INK .DOCX | - Machiavelli - Apr 22, 2025

SKYNET Crypts 🔐
1️⃣ Crypt

50/300$ crypt exe per build
$50 UNIQUE STUB .bat (.NET only) Bypass WD 100%
$75 PRIVATE STUB .exe (.Native only) NO Startup (0-1/26) Chrome Bypass included.
$100 UNIQUE STUB Chrome bypass + 15$ [100mb file inside the 1mb rar/zip] Bypass WD 100%, output vbs/bat/exe. Chrome bypass included
$150 PRIVATE STUB (0-2/26) Chrome bypass included.
$200 PRIVATE STUB (0/26) Chrome bypass included.
$300 PRIVATE STUB + Exploit (CUSTOM SOLUTION)

Please, provide your .ico before crypt

❗️ Terms for private stubs:

➡️ A 24-hour warranty is now given for one-time crypts.

➡️ The warranty is as follows: if your encrypted file gets exposed within 24 hours after the crypt, we will do one re-encrypt for free.

➡️ Conditions: the file must not be leaked to distribution sites like virusscan.jotti.org, virustotal.com, etc.

❗️Terms for all stubs
(Provide stub with no settings! NO UAC Bypass, Persistence/Startup. Only settings is keylogger on RAT is ok. If you are unsure ask, and send pictures of settings before we create stub)

We have our own AUTORUN/PERSISTENCE/STARTUP from our side.

IF YOU PROVIDE STUB WITH SETTINGS, AND WE ARE STARTED CRYPTING AND CRYPT DONT WORK, NO REFUND.


2️⃣ Smartscreen

Smartscreen appears when downloaded file from a browser. Bypassing with a rar archive or a legal signature

3️⃣ EXT.

Doing exe > vbs,bat,msi,com,pif,cmd,scr... Exploits: xll,docx, lnk, url...

4️⃣ Additionally

¦ Better to change crypt once in 2-3days or 2-3k installs;
¦ Startup is available — launch the file after rebooting the system;
¦ Can Find Any File at VirusTotal, download it or get sources;
¦ Can bind legal or any files to urs PE (almost all ext)

5️⃣ Payment

BTC, XMR,



SKYNET Crypts
⚡️ Exploits

Exploits that currently available are XLL, LNK, URL, DOC/XLS Macro

A description of each exploit is available below. Sploits are available individually ($150) and as Subscription

Exploit Subscriptions

XLL Exploit [1 Month License] +SERVICE PACK LICENSE BONUS (3 single crypt, EXT spoofer, file pumper.)
How it works?

▹ The XLL exploit is a fairly new type of exploit. Works on any version of Office, requires one confirmation;
▹ Downloads and runs your file, also has any text inside afer PE executed. You can edit your content inside your .xlsx file at ur's link;

• Bypassing WD;
• Bypassing Chrome;

• Bypassing SmartScreen;
• Bypassing Gdrive;

• 0-1/26;
• Unlimited Builds.

$499/monthly.

LNK & URL Exploit [1 Month License] +SERVICE PACK LICENSE BONUS (3 single crypt, EXT spoofer, file pumper.)
LNK PLUS URL
▹ The LNK/URL exploit is a BRAND NEW type of exploit. Works on any version of Windows [last 7, 8, 10, 11]. LNK is SILENT (doesn't require confirmation);
▹ URL requires one confirmation. Both support any extensions and icons;

▹ LNK must be sent in a regular zip archive without password, since if you download LNK without archive - browser changes its extension to .lnk.download;
▹ URL does not require an archive to be downloaded from a browser. When downloading from a browser, it requires additional confirmation;

• Bypassing WD;
• Bypassing Chrome;

• Bypassing SmartScreen;
• Bypassing Gdrive;

• 0/26;
• 0-1/70 on VT [DONT UPLOAD FILES TO VT!];
• Unlimited Builds.

$799/monthly


DOCX & XLSX MACRO Exploit [1 Month License]

$399/monthly



SKYNET Crypts 🔐
XLL

Excel files, PE executed after confirmation (1click), working at all MS Offices, even at 365. Bypassing WD, Chrome, Smartscreen, Gdrive.

❇️ Working not only with exe;

❇️ Bypassing Google Drive; [Gmail attachment from Gdrive (5th btn at gmail mail];

❇️ Stub 0-2/26, Bypass WD, Chrome, Smartscreen;

❇️ Web Builder Available;

❇️ Size up to 1mb;

❇️ 2 Versions of Files for any MS Office bits (x64&x86).

❇️ Any your content or text inside Excel after execution confirmation

SKYNET Crypts 🔐
[Image: xllupdategif.gif]
XLL Work [Image: XLL-work.jpg]

SKYNET Crypts 🔐 (
Doc (XLS)
[Image: DOC-XLS.jpg]
❇️ DOC/XLS now bypassing WD, chrome,smart. Not bypassing gmail, avast,kis;

❇️ Require macro click (1click);

❇️ Working at all MS Offices where there are Macro (up to 2019 inclusive);

❇️ The contents of the document (your text, etc.) are available before or after activating the macro;

❇️ Bonus in the form of a pack of images to activate the macro

Skynet Crypts
[Image: INKURL-ezgif-com-video-to-gif-converter.gif]
INK (URL)

🔥🔥🔥 Added *.url / *.lnk exploits

💎 URL: is a .url file (visible in Windows as an Internet Shortcut), bypasses WD, Smart, Chrome, Gdrive, goes to the inbox, requires one confirmation at startup or Smartscreen;

🔑 LNK: .lnk file (in Windows - Shortcut), bypasses WD, Smart, Chrome, does not require confirmation

They both support any file extension and icon. That is, for example, the lnk or url file will be file.pdf with a PDF icon


LNK:
❇️ added a full def bypass when downloading from a browser;
❇️ LNK is sending in a regular zip archive without a password, since if you download LNK without archive, the browser changes its extension to file.lnk.download.

URL:
❇️ Does not require an archive, downloads naked with the required extension;
❇️ When downloading from a browser, on some machines, additional confirmation is required


SKYNET Crypts
❗️ I don’t make PDFs because Adobe is constantly patching cve's in new versions of Reader/Acrobat products, PDF has never worked the way the client would like, and there are and almost never will be actual exploits for the newest versions of these products. Updates are extremely frequent and all 0days are patched very quickly

For files similar to PDF, there are options .exe/.scr (with a PDF icon), lnk/url (with any icon)

DOC now only macro, there are no macros in the latest versions of offices, for example 365, this method will not work there.


SKYNET AUTOCRYPTER

✅ Reduced price
✅ UNIQUE quality
✅ Fast file delivery
✅ Crypt of many files
✅ Several crypt methods
✅ 0-2/26 Avcheck
✅ 24/7


.NET CRYPTER SUBSCRIPTION
$100

Affordable monthly subscription for .NET-based protection of .BAT and PowerShell scripts with advanced features.

Unlimited crypting of .BAT and .PS1 files for 30 days using .NET technology
Full Windows Defender bypass
Anti-debugging features
AMSI Bypass
Memory Loding
String encryption
Runtime obfuscation
Bypass Smartscreen
Assembly protection
Works with all .NET framework versions
Persistence/autorun capabilities included
Startup options for system reboot survival
Regular updates for new security patches
Basic technical support via Telegram

AV/EDR KILLER


We use a vulnerable driver, through it we find the ETHREAD structure by parsing, in it we patch the Previous Mode parameter, after that we find it with access to reading and writing to the kernel memory SeValidateImageData, we patch it, after that we can load any driver unsigned.

After that we load our Killer driver, through EPROCESS parsing it gets a list of active processes, compares them with the names of antiviruses, if there are matches then it kills them.

Then it uses PsSetLoadImageNotifyRoutineand creates monitoring for the creation of new processes in this monitoring it checks the name of all new processes, if the name matches the name of the antivirus, then it blocks its loading.

Thus, not allowing the antivirus to perform correct work

. Then the driver launches your payload and makes autoload if required.


There is support for the following antiviruses:
Windows 10 Defender
Windows 11 Defender
Bitdefender
Avast
ESET NOD32
Kaspersky
Dr.WEB
;)🇺🇸However , additional antiviruses may be added upon your request (Sentinel one, Crowdstrike etc) DM for price.




Also additional functionality:

Your payload can either be dumped to disk and run as a process, or loaded into the memory of another process
Auto startup - loads the killer at the early stages of system startup, and kills antiviruses even before full initialization, also launching your payload
UAC bypass - a new bypass method found by me personally, completely undetectable, not used anywhere before. Bypasses the standard UAC protection level
Ring0 rootkit - all actions of the killer will be completely hidden, your payload will be completely hidden from the task manager, explorer and similar utilities, also the autoload will be completely hidden if you have it. (The rootkit completely bypasses PatchGuard)
Smart screen bypass - bypass smartscreen via dll sideloading
All additional functionality comes at an additional cost.
ℹ️At the moment, all additional functionality is FUD for all antiviruses listed


Most killers use a driver that provides IOCTLs through which you can kill processes directly. This is the simplest method, which does not require writing your own driver or anything in general. You can just use ready-made code from GitHub, and, basically, killers just use known drivers that other people have found. This method is very simple, but such killers do not live long


. We use a completely different approach. We use our own driver that was previously unknown and that works on a different principle, allowing us to load our own driver that can hide itself and kill antivirus processes before they appear in the system, by installing a callback on the process creation function. This will allow the killer to remain undetectable for much longer and work much more efficiently than others


Base Price: $400

Auto startup: + $40
UAC bypass: + $50
Ring0 rootkit: + $150
Smart Screen bypass via DLL sideloading: + $40






Legal Disclaimer
This software ("SKYNETCRYPTER.VIP") is provided for AUTHORIZED SECURITY TESTING PURPOSES ONLY. By downloading, installing, or using this software, you acknowledge and agree to the following:

This tool is intended exclusively for security professionals conducting authorized penetration testing, security audits, or educational purposes.
You MUST obtain explicit written permission from the owner of any system, network, or data before using this tool.
The creator(s) of this software accept NO RESPONSIBILITY for any misuse, damage, or illegal activity resulting from the use of this software.
Unauthorized use of this software against systems without proper authorization may violate local, state, federal, or international laws.
Users are solely responsible for ensuring their use of this software complies with all applicable laws and regulations.
This software is provided "as is" without warranty of any kind, either expressed or implie
[contract=tid]Start Contract[/contract]

Paid Sticky Post - Sticky Bot - Apr 22, 2025

Hi, I'm Sticky Bot. The owner of this thread has purchased a Paid Sticky. Hack Forums does not get involved in deals or deal disputes. We do not vouch for the product or the service offered by members. Please note that all deals are at your own risk. The sticky will expire on Apr 29, 2025. If you or a loved one are interested in buying a sticky please visit this page: Buy Sticky. For more information about Paid Stickies you can read our Help Doc.

Paid Sticky Post - Sticky Bot - May 9, 2025

Hi, I'm Sticky Bot. The owner of this thread has purchased a Paid Sticky. Hack Forums does not get involved in deals or deal disputes. We do not vouch for the product or the service offered by members. Please note that all deals are at your own risk. The sticky will expire on May 16, 2025. If you or a loved one are interested in buying a sticky please visit this page: Buy Sticky. For more information about Paid Stickies you can read our Help Doc.

RE: SKYNETCRYPTER.VIP | UNIQUE&PRIVATE | .EXE .VBS .BAT | EXPLOITS .XLL .XLS .INK .DOCX | - eakostomarov - May 13, 2025

hi, is there any video demonstrating the work, I am interested in the maximum hyde, it is desirable that there be a web panel and after infection I could choose the time when I need to attack a separate machine, is this possible?

RE: SKYNETCRYPTER.VIP | UNIQUE&PRIVATE | .EXE .VBS .BAT | EXPLOITS .XLL .XLS .INK .DOCX | - Machiavelli - May 13, 2025

(May 13, 2025 01:29 PM)eakostomarov Wrote:  hi, is there any video demonstrating the work, I am interested in the maximum hyde, it is desirable that there be a web panel and after infection I could choose the time when I need to attack a separate machine, is this possible?

Hello sir,

This is crypts and exploits.

This is not a RAT or Loader where you hold "Clients".

Best Regards.

RE: SKYNETCRYPTER.VIP | UNIQUE&PRIVATE | .EXE .VBS .BAT | EXPLOITS .XLL .XLS .INK .DOCX | - Crazyhustle - May 23, 2025

DOCX & XLSX MACRO Exploit [1 Month License]
it one click ?

RE: SKYNETCRYPTER.VIP | UNIQUE&PRIVATE | .EXE .VBS .BAT | EXPLOITS .XLL .XLS .INK .DOCX | - Machiavelli - May 23, 2025

(May 23, 2025 02:12 AM)Crazyhustle Wrote:  DOCX & XLSX MACRO Exploit [1 Month License]
it one click ?

Hello sir,

It's macro but yes 1 click.

url/lnk is 1 click without any macro or something.

Paid Sticky Post - Sticky Bot - May 23, 2025

Hi, I'm Sticky Bot. The owner of this thread has purchased a Paid Sticky. Hack Forums does not get involved in deals or deal disputes. We do not vouch for the product or the service offered by members. Please note that all deals are at your own risk. The sticky will expire on May 30, 2025. If you or a loved one are interested in buying a sticky please visit this page: Buy Sticky. For more information about Paid Stickies you can read our Help Doc.

RE: SKYNETCRYPTER.VIP | UNIQUE&PRIVATE | AV/EDR KILLER | EXPLOITS .XLL .XLS .INK .DOCX | - Cassahav - May 27, 2025

vouch copies?? huh boss

RE: SKYNETCRYPTER.VIP | UNIQUE&PRIVATE | AV/EDR KILLER | EXPLOITS .XLL .XLS .INK .DOCX | - Machiavelli - May 28, 2025

(May 27, 2025 07:47 PM)Cassahav Wrote:  vouch copies?? huh boss

Hello sir,

Yes.

RE: SKYNETCRYPTER.VIP | UNIQUE&PRIVATE | AV/EDR KILLER | EXPLOITS .XLL .XLS .INK .DOCX | - DramaKing - Jun 8, 2025

Has anyone actually tried this?

RE: SKYNETCRYPTER.VIP | UNIQUE&PRIVATE | AV/EDR KILLER | EXPLOITS .XLL .XLS .INK .DOCX | - Machiavelli - Jun 9, 2025

(Jun 8, 2025 04:46 AM)DramaKing Wrote:  Has anyone actually tried this?

Hello sir,

Yes i have alot of daily clients.

I'm just selling mostly from telegram.

You can get a vouch copy if you want :)

RE: SKYNETCRYPTER.VIP | UNIQUE&PRIVATE | AV/EDR KILLER | EXPLOITS .XLL .XLS .INK .DOCX | - JonteAka - Jun 10, 2025

Can i get a vouch copy of the bat crypt?

RE: SKYNETCRYPTER.VIP | UNIQUE&PRIVATE | AV/EDR KILLER | EXPLOITS .XLL .XLS .INK .DOCX | - Machiavelli - Jun 10, 2025

(Jun 10, 2025 06:57 AM)JonteAka Wrote:  Can i get a vouch copy of the bat crypt?

Hello sir,

Sorry, Only trusted HF members with high rep is getting vouch copies.

Best Regards,

RE: SKYNETCRYPTER.VIP | UNIQUE&PRIVATE | AV/EDR KILLER | EXPLOITS .XLL .XLS .INK .DOCX | - Cryptoboy24 - Jul 26, 2025

Does this cryptor work with the Violetrat payload?