Developed in C++ and FASM
No dependencies
Resource cloner
FUD, runtime, scantime, bypass all av's including kaspersky, avast, and pretty much all other runtimes. (Unless the crypted file calls an API hooked with a ring0kit such as SetWindowsHookEx for keyboard hooks - nothing can bypass such paranoia)
It uses a unique method to protect the file, so no RunPE/WriteProcessMemory/etc API calls.
I will implement "add to startup" and "install" features. There is currently no support for EOF data. (This can be easily added)
How much would you pay for this per month?
(Feb 7, 2014 01:31 AM)N3oNight Wrote: it dosent matter if uses runpe or not,
the thing matter is for how many days or how long will it be FUD.
And if it has dependencies.
#Thread
For FASM i would pay 50$/week for C++ 20$/week max.
What difference would it not being RunPE make? I honestly don't know.
(Feb 7, 2014 04:45 AM)Conqueror Wrote: Well.. every memory scan would detect it so.. its same of a runpe except that doesn't uses detected APIs by HIPS and Firewall.
Almost every single HIPS and Firewall detect RunPE nowadays. It's a dead horse, when there are so many better alternatives to use.
It is FUD for weeks at a time, and it has no dependencies outside of the windows operating system itself. It only needs kernel32.dll to run (and well, of course ntdll.dll) as well as any dll's that the crypted process needs (such as ws32_dll.dll, etc)
(Feb 7, 2014 09:41 AM)Razοr Wrote: hips still have huge problems detecting dynamic forking and i don't see how a firewall should...
Also for the FUD-time, how can you tell? I tested a lot of techniques to increase it and only testing them on long-term was able to tell if they are effective.
All an antivirus needs to do is hook a few functions (such as CreateProcess, NtUnmapViewOfSection) and they will instantly know that you are using RunPE thus detect your payload.
Not every antivirus does this- but a lot do. Your RunPE crypter might be scantime FUD, but it won't work in runtime against many antiviruses these days.
Maybe in 2008/2009/2010 you could get away with RunPE; but these days its just something you can't get away with anymore.
In my opinion, there's no point calling a crypter FUD if it can't get past the AV's it should during runtime.
(Feb 7, 2014 09:41 AM)Razοr Wrote: hips still have huge problems detecting dynamic forking and i don't see how a firewall should...
Also for the FUD-time, how can you tell? I tested a lot of techniques to increase it and only testing them on long-term was able to tell if they are effective.
You can increase FUD time by giving users unique executables. Of course, there is always some "part" of your code they begin to detect- so even FUD time has its limits per reprogram.
(Feb 7, 2014 09:49 AM)Feminist Wrote: All an antivirus needs to do is hook a few functions (such as CreateProcess, NtUnmapViewOfSection) and they will instantly know that you are using RunPE thus detect your payload.
Not every antivirus does this- but a lot do. Your RunPE crypter might be scantime FUD, but it won't work in runtime against many antiviruses these days.
Maybe in 2008/2009/2010 you could get away with RunPE; but these days its just something you can't get away with anymore.
In my opinion, there's no point calling a crypter FUD if it can't get past the AV's it should during runtime.
You can increase FUD time by giving users unique executables. Of course, there is always some "part" of your code they begin to detect- so even FUD time has its limits per reprogram. Give us some more information about that unique method that you didn't invent.
(Feb 7, 2014 10:52 AM)AnonymousDDOxz Wrote: Give us some more information about that unique method that you didn't invent.
It's not publicly released. I never claimed to have invented it. It maps the executable into memory, fixes imports, relocs and passes control to it. It's also got a few layers of protection.
People just want something that is undetected by both signature scans and behavior monitoring. The 'method' used is mostly irrelevant. On a side note:
Quote:but it won't work in runtime against many antiviruses these days.
Isn't true. All 'RunPE' is, is code injection to create a zombie process and there are plenty of ways to get around HIPS for that.
(Feb 7, 2014 11:03 AM)betamonkey Wrote: People just want something that is undetected by both signature scans and behavior monitoring. The 'method' used is mostly irrelevant. On a side note:
Isn't true. All 'RunPE' is, is code injection to create a zombie process and there are plenty of ways to get around HIPS for that.
I'm sure that there are ways to get around HIPS for creating a zombie process. However, I'm sure most crypters on Hackforums are using the "standard" and "cookie-cutter" version of RunPE.
Additionally, some Antiviruses hook NtUnmapViewOfSection, WriteProcessMemory and will detect any file as malware if they call those functions.
Anyway. Nobody has really answered how much they would pay for this crypter per month.
(Feb 7, 2014 11:06 AM)Feminist Wrote: I'm sure that there are ways to get around HIPS for creating a zombie process. However, I'm sure most crypters on Hackforums are using the "standard" and "cookie-cutter" version of RunPE.
Additionally, some Antiviruses hook NtUnmapViewOfSection, WriteProcessMemory and will detect any file as malware if they call those functions.
Anyway. Nobody has really answered how much they would pay for this crypter per month.
Just make it private and sell spots for something like $200 per x week(s). Take on a few customers and you'll have way less stress with that rather than dealing with many dozens of whining kids expecting to pay $20-something a month
If you want to make a crypter that will sell welll, give it a feature that the other popular crypters don't already have. Not a feature that's pointless, but something unique and useful. Get creative. Creativity is a key component to a successful product.
(Feb 7, 2014 11:06 AM)Feminist Wrote: Additionally, some Antiviruses hook NtUnmapViewOfSection, WriteProcessMemory and will detect any file as malware if they call those functions.
That's absolute bullshit, tonnes of legitimate processes use both functions and aren't detected.
(Feb 7, 2014 02:16 PM)IRP_MJ_SCSI Wrote: That's absolute bullshit, tonnes of legitimate processes use both functions and aren't detected.
So you are telling me not no antivirus in the world hooks any processes either in ring0 or ring3?
And that no antivirus in the world will detect a file as a virus for calling:
CreateProcessA
NtUnmapViewOfSection
WriteProcessMemory (for each section)
and then setting the context,
CreateRemoteThread
You are saying that no antivirus in the world does that?
Because I'm pretty sure your claim of "legitimate software" doing the above is false. Why not show me one "legit software" that does exactly as stated above?
Your assertions are laughable and can easily be disproved in a single screenshot.
(Feb 7, 2014 02:41 PM)Feminist Wrote: So you are telling me not no antivirus in the world hooks any processes either in ring0 or ring3?
And that no antivirus in the world will detect a file as a virus for calling:
CreateProcessA
NtUnmapViewOfSection
WriteProcessMemory (for each section)
and then setting the context,
CreateRemoteThread
You are saying that no antivirus in the world does that?
Because I'm pretty sure your claim of "legitimate software" doing the above is false. Why not show me one "legit software" that does exactly as stated above?
Your assertions are laughable and can easily be disproved in a single screenshot.
Do you have special needs or just no understanding of how security software works?
Proactive defense (or ring 3/ring 0 hooking as noobs call it) uses pattern matching and parameter checks to detect malicious use of certain native API functions, under no circumstance does it straight out detect a process just because it called a function.
(Feb 7, 2014 02:57 PM)IRP_MJ_SCSI Wrote: Do you have special needs or just no understanding of how security software works?
Proactive defense (or ring 3/ring 0 hooking as noobs call it) uses pattern matching and parameter checks to detect malicious use of certain native API functions, under no circumstance does it straight out detect a process just because it called a function.
Come back to my thread when you have reverse engineered antiviruses, can program something more than a hello world application, and know what you are talking about.
Avast antivirus increments an integer value for each time one of the above functions is called. Of course, it would have to check parameters to increment the specified integer for the specified process.
Once that integer reaches 3, it is detected as a virus.
So please, go away and come back when you have actually reverse engineered something and know what you are talking about.
Thanks.
|
