Does your crypter have EoF support in it?
BosonCrypter | 20$/Month | FUD 0/35 | Custom Injection | Private Stub | Paused |
 (Dec 29, 2014 06:43 PM)๖ۣۣۜۜFear Wrote: Does your crypter have EoF support in it? I don't have it for now, i'll try to add it, when i found out how to locate EOF on Files.  (Jan 5, 2015 10:05 AM)m4Ntiz Wrote: I am considering buying this. What other AV's have you tested and what were the results? It uses RunPE. All RunPE crypters are detected by every HIPS at Runtime. If you use HackForums malware then it doesnt concern you since 99.99% malware that you can buy here are complete shit and are detected at runtime by themselves. I dont know if malware such as LoadHTTP and Kraken use undetected injection methods though. (Jan 5, 2015 09:52 AM)darkstrike420 Wrote: http://postimg.org/image/bil4ix61j/ This file dont come from this crypter man, it come from a crypter i'm coding.  (Jan 5, 2015 09:52 AM)darkstrike420 Wrote: http://postimg.org/image/bil4ix61j/
Assert failure(PID 10704 [0x000029d0], Thread: 10960 [0x2ad0]): pBuffer != NULL
(Jan 5, 2015 10:41 AM)Aristocles Wrote: This is the sample the coder of this crypter sent me for analysis. I don't own this crypter but I own a sample crypted with this. It is detected at runtime by all HIPS because it uses RunPE. (Jan 5, 2015 10:33 AM)Wardow Wrote: This file dont come from this crypter man, it come from a crypter i'm coding. So? You're saying your private crypter 100% for yourself is piece of shit compared to crypter ur selling to everyone? Nice logic 15 year old kid. Both use RunPE correct? Then both are detected at Runtime by same Antivirus. This applys to every crypter on this forum that uses RunPE.
Jan 5, 2015 10:50 AM
(This post was last modified: Jan 5, 2015 10:50 AM by Wardow.)
Go away from your sales trash man, I GAVE YOU A SAMPLE FROM A CRYPTER I AM CODING IT'S NOT DONE YET PRIVATE FOR ME MEAN NOT SHARED OR ON SALES, YOU UNDESTAND MY FUCKING ENGLISH MAN???
(Jan 5, 2015 10:42 AM)iamskid Wrote: This is the sample the coder of this crypter sent me for analysis. I don't meant to be mean with you though, and I still don't want to. But it seems that Wardow was misunderstood; indeed he is coding a "private crypter" (understand what you want here) and he decided to give you a sample crypted by his private stuff. Nonetheless it is not a sample crypted by BonosnCrypter.
Assert failure(PID 10704 [0x000029d0], Thread: 10960 [0x2ad0]): pBuffer != NULL
(Jan 5, 2015 11:12 AM)Mr_Anonymous Wrote: come on man, stop trashing him. he asked you to stop. Stop sucking his dick. He is misadvertising his product. The detection is from his RunPE not 1337 hardcore methods. If he was sure BosonCrypter is KIS undetected I would already have a sample to analyse but he is not sure. (Jan 5, 2015 11:14 AM)Aristocles Wrote: I don't meant to be mean with you though, and I still don't want to. But it seems that Wardow was misunderstood; indeed he is coding a "private crypter" (understand what you want here) and he decided to give you a sample crypted by his private stuff. Do you have mental issues? The detection comes from his RunPE(VirtualAllocEx +WriteProcessMemory and SetThreadContext). This crypter also uses the same combination and 99% other crypters on this forum do too and they all are equally detected at runtime. Bro learn to code then you will laugh at this Wardow noob. (Jan 5, 2015 11:16 AM)Wardow Wrote: Stop fucking post here! Do you have mental issues? The detection comes from RunPE(VirtualAllocEx +WriteProcessMemory and SetThreadContext). This crypter also uses the same combination and 99% other crypters on this forum do too and they all are equally detected at runtime.
Jan 5, 2015 11:19 AM
(This post was last modified: Jan 5, 2015 11:21 AM by Wardow.)
You dont even know my RunPE, if you know my runpe, you must have decompiled it, so, you're in fault here, as it's forbidden.
If you post another time here, i go alert an admin. (Jan 5, 2015 11:19 AM)Wardow Wrote: You dont even know my RunPE, if you know my runpe, you must have decompiled it, so, you're in fault here, as it's forbidden. I didn't decompile anything. RunPE stands for that combination. If you used a different combination then you wouldn't call it a RunPE. HackForums coders are only capable of using RunPE since they mostly copy+paste code they don't understand(just like you're doing now). You should stop calling it your RunPE since you 100% copy+pasted it otherwise you would have had used a better method of injecting the payload. |
|
|
