Edited the title to show that this is my observation and findings, and true from my belief.
Disclaimer: This is true based on my findings as of 12/12/2013. The crypter may get updated to alter or remove this functionality.
Summary: Byte Crypter binds a downloader with the files it crypts, that downloads a BitCoin miner from
http : // www . diablo3keygen . net / crvbox . exe after 20 minutes of file execution.
Details: So I recently bought Byte Crypter (https://hackforums.net/showthread.php?tid=3463236). Crypted my RAT server file. Byte Crypter made it FUD, which is good. I update a bunch of my slaves with this crypted file, and they all connected back to me good. After a while I noticed a bunch of them had the same vbc error showing up on their screen. So I got a little suspicious, as to what was happening. It had to be either my RAT (but that has never shown this issue before) or the Byte Crypter which was a new entity in my setup. To get to the bottom of this:
1. I work for a place that has a lot of machines lying around. I picked two of them and set them up with brand new OS (lets call them Machine1 and Machine2).
2. Checked to make sure nothing was installed on the startup of these machines.
3. I then created a .net app that just shows a MessageBox with foo in it. (lets call it MyApp.exe). its code is just MessageBox.Show("foo");
4. Then crypted MyApp.exe with Byte Crypter (lets call this crypted file MyAppCrypted.exe).
5. Ran MyApp.exe on Machine1, and my MyAppCrypted.exe on Machine2. Both showed the messagebox with foo, which I closed.
6. Checked startup of both and both were clean.
7. Came 30 minutes later, and Machine1 still had nothing installed in the startup, but Machine2 had something setup in the startup, that could not be disabled
8. cleaned both machines again to new OS and this time repeated the same thing, but kept fiddler running
9. Came 30 minutes later, and Machine1 showed no fiddler activity, but Machine2 had downloaded a file from http : // www . diablo3keygen . net / crvbox . exe
10. Checked the size of crvbox.exe and it was 241kb
11. Checked the size of crvbox.exe next day, and now it was
299kb. so this file is actively getting updated as well to be the newest or fuddest.
Sent a Pm to Mark, the seller of Byte Crypter and he says his crypter is clean and its either my foo app that is downloading the miner or my internet connection is doing that. To check that I tried the same experiment on a machine at home (a different internet connection) and same results as before. So blaming this on MessageBox.Show("foo"), or internet connection or Microsoft having built this into their OS is a far fetched thing than the crypter actually being bugged to download the miner. Do as you please with this information.
Disclaimer: This is true based on my findings as of 12/12/2013. The crypter may get updated to alter or remove this functionality.
Summary: Byte Crypter binds a downloader with the files it crypts, that downloads a BitCoin miner from
http : // www . diablo3keygen . net / crvbox . exe after 20 minutes of file execution.
Details: So I recently bought Byte Crypter (https://hackforums.net/showthread.php?tid=3463236). Crypted my RAT server file. Byte Crypter made it FUD, which is good. I update a bunch of my slaves with this crypted file, and they all connected back to me good. After a while I noticed a bunch of them had the same vbc error showing up on their screen. So I got a little suspicious, as to what was happening. It had to be either my RAT (but that has never shown this issue before) or the Byte Crypter which was a new entity in my setup. To get to the bottom of this:
1. I work for a place that has a lot of machines lying around. I picked two of them and set them up with brand new OS (lets call them Machine1 and Machine2).
2. Checked to make sure nothing was installed on the startup of these machines.
3. I then created a .net app that just shows a MessageBox with foo in it. (lets call it MyApp.exe). its code is just MessageBox.Show("foo");
4. Then crypted MyApp.exe with Byte Crypter (lets call this crypted file MyAppCrypted.exe).
5. Ran MyApp.exe on Machine1, and my MyAppCrypted.exe on Machine2. Both showed the messagebox with foo, which I closed.
6. Checked startup of both and both were clean.
7. Came 30 minutes later, and Machine1 still had nothing installed in the startup, but Machine2 had something setup in the startup, that could not be disabled
8. cleaned both machines again to new OS and this time repeated the same thing, but kept fiddler running
9. Came 30 minutes later, and Machine1 showed no fiddler activity, but Machine2 had downloaded a file from http : // www . diablo3keygen . net / crvbox . exe
10. Checked the size of crvbox.exe and it was 241kb
11. Checked the size of crvbox.exe next day, and now it was
299kb. so this file is actively getting updated as well to be the newest or fuddest.
Sent a Pm to Mark, the seller of Byte Crypter and he says his crypter is clean and its either my foo app that is downloading the miner or my internet connection is doing that. To check that I tried the same experiment on a machine at home (a different internet connection) and same results as before. So blaming this on MessageBox.Show("foo"), or internet connection or Microsoft having built this into their OS is a far fetched thing than the crypter actually being bugged to download the miner. Do as you please with this information.
