[Fulya Donmez]

SmokeLoader isnt even that good lmao, its one of the cheapest bots theres around

Which one is better than smoke?

[05317832892]

Problem is most of the shit on here is C&P.

mehtevas, AriesCoder and Friedrich Nietzsche are legit. The rest is just C# public RunPE bs.

It's easy to tell if a crypter is shit, just look at their sales thread, if its proxy sell horse shit, they will promote their fancy "vbc" or "runasm" injection or their file pumper (like why the fuck is this even a thing? you want to make your file small with low entropy and normalised sections, not huge with 90% .data 7.9 entropy), or their startup methods.

Real coders promote the shit that matters, syscall extraction, stub size, API bypasses, heuristics.

[Marriot170]

Problem is most of the shit on here is C&P.

mehtevas, AriesCoder and Friedrich Nietzsche are legit. The rest is just C# public RunPE bs.

It's easy to tell if a crypter is shit, just look at their sales thread, if its proxy sell horse shit, they will promote their fancy "vbc" or "runasm" injection or their file pumper (like why the fuck is this even a thing? you want to make your file small with low entropy and normalised sections, not huge with 90% .data 7.9 entropy), or their startup methods.

Real coders promote the shit that matters, syscall extraction, stub size, API bypasses, heuristics.

Thank you for existing and for saying the right things.
This post should be pinned for view in the cryptography section..

Almost every other .NET crypter here is based off Aeonhack's runPE.
Then they use ConfuserEx and call it 'ADVANCED USG'.

[05317832892]

Thank you for existing and for saying the right things.
This post should be pinned for view in the cryptography section..

Almost every other .NET crypter here is based off Aeonhack's runPE.
Then they use ConfuserEx and call it 'ADVANCED USG'.

Lol my crypter is 100% asm so I can do a lot of black magic.

It uses sysenter on native x32 machines and transition on x64 to evade all ring-3 hooks, doesn’t map ntdll or rely on the in memory one provided by winloader.

The engine is about 100 asm instructions, very small. It’s stored xor’d in .data. I just jump to it once the pre req has completed. It’s not position independent though because it relies on known offsets.

Most shitty crypters will AES the binary or use some other high entropy blaintent bs, because I’m working with asm I can encode the PE in the junk asm operand values, for example:

Code

mov eax,0

Will be encoded as

Code

\xB8 \x00 \x00 \x00 \x00

However if I want to store a PE file, I split it up into dwords (4 byte sections) and xor each against a fixed key, then use the value as the operand for a junk code instruction.

Examples of instructions that can work for this are as follows:
-JMP (and it’s variations)
-CALL
-MOV (and some of its variations)
-ADD
-SUB
-OR
-AND
-PUSH

Most of them have a ratio of 1:4 so only around 25% size increase in return for valid normal (ish) entropy heuristically correct file. It also doubles up as junk code that’s never executed.

One odd thing I have noticed in using this technique though is that there’s no limitations on jmp and call instructions, usually they should only point to somewhere in the range of (PE Base address + Total virtual size) however AVs have no problem with a series of hard coded jumps to high/low memory locations.

My stub also has self modifying code within .text, it calls virtual protect against the base of .text to allow modifications, it then modified the values in the xor decryption routines.

There are 2 decryption routines, 1 for the engine, 1 for the payload PE file. These are fairly obvious if you look disassemble however the self modifying code will modify the xor values. If you look at the binary in IDA, you can see the decryption routine, however at run-time, the “hardcoded” key used to decode is altered via self modification from a different section of code. This causes confusion for an beginner analyst as he will see only 1 xref to the engine code but the xor doesn’t actually work because the key is invalid.

Oh and there’s a shit ton of anti-debug / anti-automation / anti-sandbox. All under 15kb, FUD.

I’ve basically just given all the retards on here a blueprint for a good crypter, too bad none of them know a language other than vb.net

[0x0F0C]

However if I want to store a PE file, I split it up into dwords (4 byte sections) and xor each against a fixed key, then use the value as the operand for a junk code instruction.

Examples of instructions that can work for this are as follows:
-JMP (and it’s variations)
-CALL
-MOV (and some of its variations)
-ADD
-SUB
-OR
-AND
-PUSH

Great Work !  , but some AVs (like Comodo / Kaspersky / Avira /Avast /Bitdefender ) disassemble the code and check if it's junk code .
they check if you assign value to register and dont use them , check validity of MOV/JMP/Call Addresses  ..... .
And you should have full code disassembler in your stub right ?

[05317832892]

Great Work !  , but some AVs (like Comodo / Kaspersky / Avira /Avast /Bitdefender ) disassemble the code and check if it's junk code .
they check if you assign value to register and dont use them , check validity of MOV/JMP/Call Addresses  ..... .
And you should have full code disassembler in your stub right ?

The last part is incorrect in my experience, when I have junk code that jumps to fake addresses it doesn't cause detection.

I encode it like

mov eax,BYTES
xor eax,BYTES
mov BYTES, eax
add [BYTES],eax

So it is junk code however interlaced references make it look fine.

Code

global _start

section .text
_start:
    call _cabbage
_cabbage:
    mov    eax,0

Then I opened up in hxd and changed the call to an invalid address

https://www.virustotal.com/#/file/e57c8d.../detection

2/65, neither of those detections are as a result of the jump

By contrast here is the identical code with the call left intact and valid

https://www.virustotal.com/#/file/820eee.../detection

3/65 ironically

[0x0F0C]

Then I opened up in hxd and changed the call to an invalid address

https://www.virustotal.com/#/file/e57c8d.../detection

2/65, neither of those detections are as a result of the jump

By contrast here is the identical code with the call left intact and valid

https://www.virustotal.com/#/file/820eee.../detection

3/65 ironically

i did a lot of test in this topic
there is no detection because the file is small , if you add APIs and a lot of junk code like that, AVs go nuts

[05317832892]

i did a lot of test in this topic
there is no detection because the file is small , if you add APIs and a lot of junk code like that, AVs go nuts

What kind of APIs do you use? Does execution ever reach the junk code in your stub?

[0x0F0C]

What kind of APIs do you use? Does execution ever reach the junk code in your stub?

it doesn't matter , any apis will trigger them . And yeah , i tested both situations.

[05317832892]

it doesn't matter , any apis will trigger them . And yeah , i tested both situations.

Any variation in the sizes of the data encoded?

Have you tried hiding it in export names?

[ganstephanos]

Private use, targeted machines

no spreading

to bad no programmer doesn't see the honeypot of money opportunity here

Get a private crypt/crypter done/made.