Traffic service & campaign optimization ◆ ZexoCard: no-KYC virtual crypto cards ◆ Spoof Call and Spoof SMS set any caller ◆ Private Crypter - Unique Private Stubs ◆
Home Upgrade Search Memberlist Extras Hacker Tools Award Goals Help Wiki Contact
Hack Forums Hacks, Exploits, and Various Discussions Blackhat • Red Team • Offensive Security Cryptography, Encryption, and Decryption › Digital Certification Singer v1.5

New Reply 

Digital Certification Singer v1.5
Tee Plow
Tee Plow Offline
[bin@HF:]
***
HF l33t
Posts:
1,912
Threads:
37
Credibility:
2801
Popularity:
253
βytes:
β 0
Game XP:
0
Dec 19, 2016 06:29 PM
(Dec 19, 2016 06:20 PM)xHeaven Wrote:  The original file is a Quasar RAT stub, I tried to sign with a Google Chrome certification. I'm totally confused, lol.


I tried with an another file, same results.. [Google Chrome cert.]

Before: https://www.pscan.xyz/results.php?id=KGENeMYNyRGZcpKh
After: https://www.pscan.xyz/results.php?id=ncdfoccOXVfeCCAP

And with the same file, with an another certification [Avast]

Before: https://www.pscan.xyz/results.php?id=KGENeMYNyRGZcpKh
After: https://www.pscan.xyz/results.php?id=xdKwxYBTiXASiFPD

Lol, interesting.. O.o IDK, thanks for the share, I'm going to sleep.

you are wlc my friend 🤝
Office Macro Builder | Word/Excel | Stable | FUD | Cheap
Twistd
Twistd Offline
[bin@HF:]
*
Registered
Posts:
1,912
Threads:
4
Credibility:
000
Popularity:
101
βytes:
β 0
Game XP:
23
Dec 20, 2016 12:58 AM
(Dec 19, 2016 06:15 PM)LanMan Wrote:  I don't, we were just talking about scantime and emulation results, well if you have a 45/56 stub at scantime, runtime isn't your priority haha 😁

Fake signature != anti emulation
Why would you not fud your detections properly? Adding a fake signature would probably create more runtime detections than it already has as it cannot be validated.
Tee Plow
Tee Plow Offline
[bin@HF:]
***
HF l33t
Posts:
1,912
Threads:
37
Credibility:
2801
Popularity:
253
βytes:
β 0
Game XP:
0
Dec 20, 2016 04:54 AM
(Dec 20, 2016 12:58 AM)Twistd Wrote:  Fake signature != anti emulation
Why would you not fud your detections properly? Adding a fake signature would probably create more runtime detections than it already has as it cannot be validated.

bla bla bla ....
Office Macro Builder | Word/Excel | Stable | FUD | Cheap
Codefuser
Codefuser Away
[closed@HF:]
Posts:
2,203
Threads:
39
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
Dec 20, 2016 05:31 AM
(Dec 20, 2016 04:54 AM)Tee Plow Wrote:  bla bla bla ....
He is right lol
This is not a reliable way of removing detections.
Tee Plow
Tee Plow Offline
[bin@HF:]
***
HF l33t
Posts:
1,912
Threads:
37
Credibility:
2801
Popularity:
253
βytes:
β 0
Game XP:
0
Dec 20, 2016 05:35 AM
(Dec 20, 2016 05:31 AM)Codefuser Wrote:  He is right lol
This is not a reliable way of removing detections.

(Dec 19, 2016 06:20 PM)xHeaven Wrote:  And with the same file, with an another certification [Avast]

Before: https://www.pscan.xyz/results.php?id=KGENeMYNyRGZcpKh
After: https://www.pscan.xyz/results.php?id=xdKwxYBTiXASiFPD

Lol, interesting.. O.o IDK, thanks for the share, I'm going to sleep.
Office Macro Builder | Word/Excel | Stable | FUD | Cheap
Codefuser
Codefuser Away
[closed@HF:]
Posts:
2,203
Threads:
39
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
Dec 20, 2016 05:58 AM

Doesn't make it reliable. Sometimes it works sometimes it doesn't. Sometimes it even adds detection.
Tee Plow
Tee Plow Offline
[bin@HF:]
***
HF l33t
Posts:
1,912
Threads:
37
Credibility:
2801
Popularity:
253
βytes:
β 0
Game XP:
0
Dec 20, 2016 06:07 AM
(Dec 20, 2016 05:58 AM)Codefuser Wrote:  Doesn't make it reliable. Sometimes it works sometimes it doesn't. Sometimes it even adds detection.

no , it's reliable you just have to choose the right certification
Office Macro Builder | Word/Excel | Stable | FUD | Cheap
LanMan
LanMan Offline
[bin@HF:]
***
HF l33t
Posts:
693
Threads:
8
Credibility:
000
Popularity:
15
βytes:
β 0
Game XP:
0
Dec 20, 2016 10:54 AM (This post was last modified: Dec 20, 2016 10:54 AM by LanMan.)
(Dec 20, 2016 12:58 AM)Twistd Wrote:  Fake signature != anti emulation
Why would you not fud your detections properly? Adding a fake signature would probably create more runtime detections than it already has as it cannot be validated.

Obviously, that's not what i said.

What if for X reason someone can't ?
It will not create more detections if your stub is already detected by all AVs
And it will only triggers while checking the signature sha1 at scantime.

I agree with you if your base stub is UD or it is crypted, no reason to do a sketchy spoof then, but if you don't have anything it's still better than nothing.

And there is a little typo in the title OP, "Certification SINGER v1.5" haha 😁
Twistd
Twistd Offline
[bin@HF:]
*
Registered
Posts:
1,912
Threads:
4
Credibility:
000
Popularity:
101
βytes:
β 0
Game XP:
23
Dec 20, 2016 11:13 AM
(Dec 20, 2016 10:54 AM)LanMan Wrote:  Obviously, that's not what i said.

What if for X reason someone can't ?
It will not create more detections if your stub is already detected by all AVs
And it will only triggers while checking the signature sha1 at scantime.

I agree with you if your base stub is UD or it is crypted, no reason to do a sketchy spoof then, but if you don't have anything it's still better than nothing.

And there is a little typo in the title OP, "Certification SINGER v1.5" haha 😁

If you don't know programming then sure i agree with you :)
Next Oldest | Next Newest
New Reply