[moveax]

inb4 codedom with string encryption
1st. Looks like copy and paste because the theme is obviously copy and pasted
2nd. Polymorphic kills the sales unless you're using it for market strategies

[BreastMilk]

In my opinion: Lying about Polymorphic, What else are you lying about?

[moveax]

At form load
File = file.replace("%bluh%", GenerateRandomChar)
GenerateCode(my.resources.source, "new")
System.Process("new.exe")

[0verdose]

Looking pretty sexy so far.

No Extension spoofer?

[Ludakrishna]

"Polymorphic .NET Crypter."
"its still polymorphic. Its just not 100% polymorphic. "

[van1lle]

Okay this not ment as flaming, bashing .NET or trolling.
This is simply a criticism you have to deal with.

The stub is 95% unique. Its not TRUE polymorphism, but its as close as you can get with .NET.

Why do you claim it as Polymorphic when it is not?
There is no gray zone between polymorphic or not. Since your decrypter or what else do you have to decrypt the "stub", "runPE" or anything else is not mutatig each time, it is NOT polymorphic. It is only dynamically reencrypted each time. The anti-virus system won't compare the encrypted data. It looks for something like a decrypter.

I'm not going to share how I do this, as its a private method I developed.

Such a thing has been released for free in the .NET section and is not hard to create. I will edit this as soon as i can find the link to the thread.

What is good in my eyes:
- The GUI. It doesn't affect the functionality of the crypter though.

~van1lle

[Ludakrishna]

Think about it... TRUE polymorphism isn't even possible in this context because at the end of the day, the byte still has to suspend a legitimate file and inject itself into it, and this isn't possible if it's polymorphic unless you had 100's of FUD RunPE's...

who even uses runpe's nowadays? its a lame ass method from 2004. 😏😏😏

[van1lle]

You can't apply yes-no concepts to this. Its still 95% polymorphic because most of the code is being moved and replaced, just not all of it. So you can't say its not either. But I'll edit the thread title.

http://en.wikipedia.org/wiki/Computer_vi...rphic_code

Polymorphic code
[...] In the case of polymorphic viruses, however, this decryption module is also modified on each infection. A well-written polymorphic virus therefore has no parts which remain identical between infections, making it very difficult to detect directly using signatures.

//EDIT:
Also, pr0t0typ3 is correct with is example: 95% pregnant. Either she is or she isn't!

[Ludakrishna]

Umm, how about every single crypter on HF?

exactly, just goes to show that nobody on HF is capable of coding an alternate method. they would rather use a lame outdated method that I doubt any of these crypter coders even understand. 🤝

[Io0oI]

polymorphism refers to self replicating it has nothing to do with obfuscation,you will get a totaly different structure,a new variant,yes some guys obfuscat a code or crypt it and then call it a "full private legit polymorfic system",wish it is not.Adding some junk code or coding a crypting program has nothing to do with coding a self-crypting program.imagine making a machine that will execute one order and only one,and making a machine that can take decisions and execute different orders. It is totaly different.this is why we call it polymorphic and not monomorphic

btw,it is very hard to acheive polymophisme using hight level programming languages,your choice is assembly,and if you are too lazy then you can use C with some inline assembly.
you cant do this with VB
.net ,just forget about it

[Io0oI]

95% of my code is different, 5% remains the same.

I compared the code of two stubs to each other using the ubuntu utility. out of all the lines, only 3 out of the total amount were the same.

anti-virus companys will take the 5% as a signature
.net languages are easy to decompile just like java.
It is Like someone who provide 95% stub updates for his customers
It will be useless

[van1lle]

Fine, I got rid of the polymorphic part, I'll just say that each stub is 95% unique. Way to much trouble.

Thanks Mr. Anderson for being reasonable. Now everything is fine in my eyes. 👍

---

The 5% is not always the same code, its still randomized. If it gets detected, I will add updated. And remember, the stub re-assembles itself every-time it is run.

At least you don't call if polymorphic anymore.

[Io0oI]

The 5% is not always the same code, its still randomized.

5% remains the same

you cant be sure it is not always the same code !

the stub re-assembles itself every-time it is run.

If you mean by this the stub will disasembles itself,changes the assembly instructions and reassembles itself,then you have a polymorphic stub witch you dont
If you mean the crypter have a number of totaly different stubs,like 30 decrypters that will be generated randomly , then you have an oligomorphic engine,it could be easely realised in any language,so instead of looking for one stub an antivirus software will look for all the stubs.That will make it hard to detect your malware.
If you mean the crypter encrypt the stub randomly using a key or an algorithm to cause different encrypted stubs,then you have a simple obfuscator,and antivirus software will look for the static part in this case the key or the encryption algorithm.

why care about what techniques are used or the "95% new output" ,in a market palce such HF's,people only care about fud,it does not matter how you did that,you can code a simple PE packer and it will do the job,people who care about polymorphic and similar shit are definitely not the people who want to spend 10-100$ on a crypter.
people here only care about dependencies and countinous FUD
make that and you will not need to ask for "good luck/look's legit.." suport posts.people love to get what they paid for,
nothing more,nothing less

[wyterzzz]

You will never learn that polymorphism != polymorphic. Those who say polymorphism instead of polymorphic have no idea what they are talking about. Polymorphism is technique used in OOP -> e.g. Animal a = new Cat().
//Excuse me for b-u-m-p-ing such an old thread but I didn't see the date...