+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Hacking Tools and Programs (https://hackforums.net/forumdisplay.php?fid=10)
+---- Thread: [Possible Warning] Ownz Crypter (/showthread.php?tid=691555)
[Possible Warning] Ownz Crypter - The Janitor - Sep 21, 2010
Hi hackforums,
Please take a good look at this
Ok so because of security reasons, i ran the borlo.exe in anubis, this is the report:
Spoiler (Click to View)
The DLL File it ran, i checked it . I found this on the internet about NTdll.dll
Spoiler (Click to View)
Than i scanned the crypter, same results.
Spoiler (Click to View)
I found the
Description Times
Exception 0xc0000135 at 0x7c96478e 1
Odd so i researched it.
It is possible it is an anti anubis.
Now tell me why does the crypter+the Borlo have an anti-anubis build in?
ALSO. My firewall said that the crypter is trying to act like a server and accept incoming connections, It was also trying to do something with .net error thing. So yeah thats what i found about it . Proof:
Spoiler (Click to View)
Novirusthanks scans:
Borlo.exe
Spoiler (Click to View)
Now this doesnt mean ANYTHING , it just means that if you crypt its detected by avira, so no problems about this :]
Crypter:
Spoiler (Click to View)
DLL File:
Spoiler (Click to View)
Explain it to me :]
* - phillybiker1022 - Sep 21, 2010
Quote:Description: File ntdll.exe is located in the folder C:\Windows\System32. Known file sizes on Windows XP are 138,760 bytes (75% of all occurrence), 216,064 bytes, 241,664 bytes.
The program has a visible window. There is no information about the maker of the file. The file is not a Windows system file. The application is loaded during the Windows boot process (see Registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run). Therefore the technical security rating is 42% dangerous, however also read the users reviews.
Recommended: Identify ntdll.exe related errors
External information from Paul Collins:
"ntdll" definitely not required. Added by the BIONET.404 TROJAN!
Important: Some malware camouflage themselves as ntdll.exe, particularly if they are located in c:\windows or c:\windows\system32 folder. Thus check the ntdll.exe process on your pc whether it is pest. We recommend Security Task Manager for verifying your computer's security. It is one of the Top Download Picks of 2005 of The Washington Post and PC World.
i think thats definitely fishy, no offense to the person who made the crypter but that raises a lot of eyebrows. :-\ i'm going to run the crypter through a few programs and get back to this thread! :)
* - The Janitor - Sep 21, 2010
(Sep 21, 2010 08:15 AM)phillybiker1022 Wrote: i think thats definitely fishy, no offense to the person who made the crypter but that raises a lot of eyebrows. :-\ i'm going to run the crypter through a few programs and get back to this thread! :)
It's not just that theres more actually,
Description Times
Exception 0xc0000135 at 0x7c96478e 1
Sometimes is used for Anti-Anubis, it was found ON The crypter and the stub.
* - jonny5252 - Sep 21, 2010
The netdll.dll is used by different Games and comes with Windows.
If you speak German you can read this http://forum.chip.de/windows-alte-versionen/ntdll-dll-ersetzen-520166.html
* - The Janitor - Sep 21, 2010
(Sep 21, 2010 08:25 AM)jonny5252 Wrote: The netdll.dll is used by different Games and comes with Windows.
If you speak German you can read this http://forum.chip.de/windows-alte-versionen/ntdll-dll-ersetzen-520166.html
Hi Johnny,
Even if its used for that (wich it isnt in this case) why would a crypter execute it? :] As you can see in my post, it can be used as malware to .
Kind regards
Gtaclick
* - jonny5252 - Sep 21, 2010
I dont know.
I only wanted to say that the part Spoiler (Click to View) wrong is.
* - The Janitor - Sep 21, 2010
Hi Johnny,
As i said i looked it up on the internet, on a security site. They might say that the CUSTOME one isn't made by windows :]
Kind Regards, Gtaclick
* - Kōtei - Sep 21, 2010
(Sep 21, 2010 08:18 AM)gtaclick Wrote: It's not just that theres more actually,
Description Times
Exception 0xc0000135 at 0x7c96478e 1
Sometimes is used for Anti-Anubis, it was found ON The crypter and the stub.
Anti-Anubis doesn't work as Anubis can't run .Net files.
So no anti-anubis was not found.
* - Fallenour - Sep 21, 2010
its false positives. starts on boot up, kinda fishy, avira says its a trojan, but its a crypter, gonna say that. all in all, your into blackhat tools, and free ones at that, your gonna get good and bad ones, if you dont trust it or its source, trash it.
* - Galaxy Wave - Sep 21, 2010
kind of fishy to be honest nice find
* - c6p0 - Sep 21, 2010
lol its loopback for antidebugger !
my crypter its clean and my borlo avira detected the runpe .
the source crypter its protected ...
reflector dont view my source,whats problem with my n00b protect ?
you dont copy this ? ....
* - phillybiker1022 - Sep 21, 2010
(Sep 21, 2010 10:43 AM)c6p0 Wrote: lol its loopback for antidebugger !
my crypter its clean and my borlo avira detected the runpe .
the source crypter its protected ...
reflector dont view my source,whats problem with my n00b protect ?
you dont copy this ? ....
after looking at the crypter for a while, i'm going to have to agree with its maker. i was a bit skeptical at first (but that has nothing to do with c6po.. just in general of a lot of the users on here) so i looked into it and i dont think it is anything to thread over. :)
* - The Janitor - Sep 21, 2010
Hmm it might not, but it is possible,
At his update 1.3 he "accidently" uploaded a rat instead of his borlo, my firewall tripped and blocked it, i can find the post somewhere just a sec...
Ah here we go, the update of 1.3 with his "mistake" now i might be crazy but someone doesnt "accidently" upload a rat instead of a stub :]
(Sep 20, 2010 01:54 AM)gtaclick Wrote: Lol you trying to infect us? With your rat ? Someone run stub in sandbox btw edit password! I cant effig crack
(Sep 20, 2010 01:32 AM)gtaclick Wrote: Hmm, Hitman Pro Says the stub is a . Cybergate Backdoor.. No good.
Someone can run it in sandbox? XD
(Sep 20, 2010 01:51 AM)c6p0 Wrote: ok sorry wrong borlo !
redownload this and try !
forget to add write ressource in memory sorry !
thanks for feedback !
* - c6p0 - Sep 21, 2010
send borlo who do not walk I'm wrong!
I have 6 Borlo created so sometimes I'm wrong.
I do not answer to you in the post!.
and I did not answer a hitman either!
has nothing to do with a rat? .
but that tells you?
whats problem you have ? my loopback anti debugger or this old post with my wrong borlo ?
you sell crypt here ?
* - The Janitor - Sep 22, 2010
LOOK:
As i said my firewall tripped because the crypter was trying to act like a server and accept incoming stuff, also the DLL it loads can be used as malware, so its possible its a virus. in version 1.3 YOU "accidently" uploaded a RAT Instead of a borlo.exe and named it borlo.exe. NOW Why would you make 6 borlo wherefrom 1 is a rat! Please read the proof i posted