Hi.
I'm looking for an ideas - how to make an anti-botkill?
I don't want code, just explain me what tricks should I use.
Thx in advance.
Big thanks .Zero, the best answer I got :)
Anti-Botkill is just a combination of hook removal, low level rootkit and file / registry key checks.
No bot killer (tested) has been able to kill my file infection routine- yet. It seems like the majority of them just check registry/file locations/signatures
(Mar 16, 2014 07:23 PM)Feminist Wrote: No bot killer (tested) has been able to kill my file infection routine- yet. It seems like the majority of them just check registry/file locations/signatures
Hahahhaha file infection, bro this isn't the 90s. I hope you're better at reversing than you are at coding malware.
(Mar 16, 2014 07:53 PM)IRP_MJ_SCSI Wrote: Hahahhaha file infection, bro this isn't the 90s. I hope you're better at reversing than you are at coding malware.
You'd be surprised how effective older techniques are.
(Mar 16, 2014 11:10 PM)Feminist Wrote: You'd be surprised how effective older techniques are.
And what happens when AV starts detecting your bots signature in random files and quarantines them.
(Mar 16, 2014 11:22 PM)IRP_MJ_SCSI Wrote: And what happens when AV starts detecting your bots signature in random files and quarantines them.
Two things can happen
Either the person assumes their AV is broken and deletes their AV or they delete all these files and reinstall their OS. Of course, I can't find a signature in my files. So unless the AV is storing hashes by dates there really shouldn't be a problem. By the way, that means polymorphism is being used- not that I am unable to select some byte string.
(Mar 17, 2014 12:15 AM)Feminist Wrote: Two things can happen
Either the person assumes their AV is broken and deletes their AV or they delete all these files and reinstall their OS. Of course, I can't find a signature in my files. So unless the AV is storing hashes by dates there really shouldn't be a problem. By the way, that means polymorphism is being used- not that I am unable to select some byte string.
lol, like you could write a decent polymorphic engine xD
(Mar 17, 2014 12:58 AM)IRP_MJ_SCSI Wrote: lol, like you could write a decent polymorphic engine xD
If you say so. You can keep deluding yourself with the whole "nobody is better than me" attitude if you wish.
(Mar 17, 2014 02:31 AM)Feminist Wrote: If you say so. You can keep deluding yourself with the whole "nobody is better than me" attitude if you wish.
I never said nobody is better than me, but you're certainly not. loool
(Mar 17, 2014 02:45 AM)IRP_MJ_SCSI Wrote: I never said nobody is better than me, but you're certainly not. loool
It sure sounds like you are saying that, based on how you interact with other people.
|
