[0xBB]

yes, if we talk about well known rat's....only cybergate needs to keep the EOF, anyway, i have my personal rat project that uses EOF only for settings (i'm currently using appendalltext) and it's clean, since the data is really really small. So...if the EOF of cybergate is not so large in size, probably would not be a problem to copy it and append to the stub, but never used cybergate. I can only say for sure that an irrilevant size of data, would probably not be a problem with avira. But for storing the entire file in your stub you can't use EOF obviously, actually i'm using cecil to add it as emebedded resource.

You don't understand, Most of managed stuff use EOF. And no matters what you put here , its detected as dropper (the lenght or the way you do it doesn't really matters). I'm kinda lost on that one, I'll have to dig . Was thinking to use a CRL process to inject to and pause the execution, close the other processs, and write eof to it on runtime.. I guess the path would be the same since its injected from it. 😑 ..

[ScΛrƒΛc3_]

You don't understand, Most of managed stuff use EOF. And no matters what you put here , its detected as dropper (the lenght or the way you do it doesn't really matters). I'm kinda lost on that one, I'll have to dig . Was thinking to use a CRL process to inject to and pause the execution, close the other processs, and write eof to it on runtime.. I guess the path would be the same since its injected from it. 😑 ..

http://elementscanner.com//?RE=96d170045...803e22e059
Rat server with EOF to store an XOR encrypted and splitted string (settings of the server, port, installa path, process name...and so on...) So... is not really always as you say..most times is detected in combination with other stuffs. What file are you tryng to FUD ? It's a known rat?

[iRtehLeet™]

(Yesterday 04:18 PM)iRtehLeet™ Wrote:  I know you need two different ways to inject managed/native, but my current Native RunPE doesn't seem to run DC servers properly with no settings on the DC server.

Because the runpe is not the issue with DC its the way you read and preserve the bytes is wrong. If your using io.readallbytes for dc it will corrupt dc servers. Pm if you need help im in class n on cell.

I have PM'ed you, I guess this is the answer because I am using this method.

[0xBB]

http://elementscanner.com//?RE=96d170045...803e22e059
Rat server with EOF to store an XOR encrypted and splitted string (settings of the server, port, installa path, process name...and so on...) So... is not really always as you say..most times is detected in combination with other stuffs. What file are you tryng to FUD ? It's a known rat?

Its nothing in particular. I just use a clean PE with eof i write in (it's quite short) and on the form run I display it on a messagebox. So it need the eof to be written to the crypted output. (like some rats like clientmesh or CG)

[ScΛrƒΛc3_]

Its nothing in particular. I just use a clean PE with eof i write in (it's quite short) and on the form run I display it on a messagebox. So it need the eof to be written to the crypted output. (like some rats like clientmesh or CG)

Try to add some embedded resources like some legit .dll like DirectShowLib, SharpDX.Direct3D9.dll....increasing the filesize, see what happens... my server has tons of codelines, all from scratch, and some .dlls i use for remote desktop and cam (i'm using directx) all this... seems to let Avira seeing my file legit. If you have 3 lines of code + EOF, most probably it become more suspicious. Anyway, it is possible to not be detected as dropper as i showed. I've to be honest, still cant say you why....but the more complex seems to be the source the better is the scan result

have you tryed to append something to a non encrypted file?

[iRtehLeet™]

I still have no idea to crypt DarkComet with a .net crypter unfortunately.

[0xBB]

Tend to agree , Most public runpe work with Darkcomet. Also depend where you inject, some are really unstable and doesn't work on all processes. Could take a look here ; https://hackforums.net/showthread.php?tid=3378694

Might get some ideas 👍

[iRtehLeet™]

My RunPE is running all other native files fine, unfortunately not a DarkComet server.

For those who flamed me, it's okay I understand where you are coming from.

For those that helped or tried, thank you. My RunPE is not public, was coded by Aeonhack. (not the public reflection.. that is not for native files. Please stop trying to flame me lol)

Thanks,.

Tend to agree , Most public runpe work with Darkcomet. Also depend where you inject, some are really unstable and doesn't work on all processes. Could take a look here ; https://hackforums.net/showthread.php?tid=3378694

Might get some ideas

Thanks!

Had enough of this, going to download DC myself and test it.

I see many posts like this saying "DC doesn't work with .net crypters" - https://hackforums.net/showthread.php?ti...id19492259