[Donkey Death Jam]

Hey,

I got pretty interested in crypters over the last few days and decided to make my own. It's in no way perfect, the output file size is horrific, mainly due to my disgusting method of storing the bytes. This is mainly why I'm releasing it. I am not sure how well this works with other RATs/Botnets but I have tested it with njrat & diamond fox and the results were decent. This crypter supports native & .NET files.

Screenshots (Click to View)



Virus scan before crypting (njrat) (Click to View)
Filename: Server.exe
Filesize: 23,50 kB
Date: 2016-05-08 17:16:15
MD5: 0a067aebf43de951c9da5017013ac338
SHA1: 0791d0616d002f1595e411c90f736f6debb74a4f
Status: Infected
Rate: 21/35

Details:
Ad-Aware - Gen:Variant.MSIL.Bladabindi.2
A-Squared - File is clean
Avast - File is clean
AVG Free - Could be a Trojan horse PSW.ILUSpy
AntiVir (Avira) - TR/Dropper.Gen7
BitDefender - File is clean
BullGuard - Gen:Variant.Gatak.5
Clam Antivirus - Win.Trojan.B-468
COMODO Internet Security - Backdoor.MSIL.Bladabindi.A@312733164
Dr.Web - BackDoor.Bladabindi.13678

ESET NOD32 - Trojan.MSIL/Bladabindi.AS
eTrust-Vet - <virus> Gen:Variant.MSIL.Bladabindi.2
FortiClient - File is clean
F-PROT Antivirus - File is clean
F-Secure Internet Security - Gen:Variant.MSIL.Bladabindi.2
G Data - Gen:Variant.MSIL.Bladabindi.2, MSIL.Backdoor.Blada
IKARUS Security - Trojan.MSIL.Bladabindi
K7 Ultimate - Trojan ( 700000121 )
Kaspersky Antivirus - HEUR:Trojan.Win32.Generic
McAfee - File is clean
MS Security Essentials - Backdoor:MSIL/Bladabindi.B
NANO Antivirus - File is clean
Norman - Gen:Variant.MSIL.Bladabindi.2
Norton Antivirus - File is clean
Panda CommandLine - File is clean
Panda Security - File is clean
Quick Heal Antivirus - EE:Malwr.Heur.MSIL.Bladabindi.2
Solo Antivirus - File is clean
Sophos - Troj/DotNet-P
SUPERAntiSpyware - Trojan.Agent/Gen-Bladabindi.Process
Trend Micro Internet Security - File is clean
Twister Antivirus - Trojan.FAA0BCDB04A5DCAD
VBA32 Antivirus - infected Trojan.MSIL.Disfa
VIPRE - File is clean
Zoner AntiVirus - File is clean

Scan Result: https://scan.majyx.net/scans/result/77e7...73d3624d5b
Scan by MaJyx Scanner



Virus scan after crypting(njrat) (Click to View)
Filename: Mini11485.exe
Filesize: 204,00 kB
Date: 2016-05-08 17:19:21
MD5: 262470053404320001e26f0eb3d3bf23
SHA1: 0aff4f2876139b550321fab876e42c53c1b2a375
Status: Clean
Rate: 0/35

Details:
Ad-Aware - File is clean
A-Squared - File is clean
Avast - File is clean
AVG Free - File is clean
AntiVir (Avira) - File is clean
BitDefender - File is clean
BullGuard - File is clean
Clam Antivirus - File is clean
COMODO Internet Security - File is clean
Dr.Web - File is clean
ESET NOD32 - File is clean
eTrust-Vet - File is clean
FortiClient - File is clean
F-PROT Antivirus - File is clean
F-Secure Internet Security - File is clean
G Data - File is clean
IKARUS Security - File is clean
K7 Ultimate - File is clean
Kaspersky Antivirus - File is clean
McAfee - File is clean
MS Security Essentials - File is clean
NANO Antivirus - File is clean
Norman - File is clean
Norton Antivirus - File is clean
Panda CommandLine - File is clean
Panda Security - File is clean
Quick Heal Antivirus - File is clean
Solo Antivirus - File is clean
Sophos - File is clean
SUPERAntiSpyware - File is clean
Trend Micro Internet Security - File is clean
Twister Antivirus - File is clean
VBA32 Antivirus - File is clean
VIPRE - File is clean
Zoner AntiVirus - File is clean

Scan Result: https://scan.majyx.net/scans/result/de8a...3dcc9b8708
Scan by MaJyx Scanner



Message me or post below for the DL link.

I understand some of you may not trust me, however, I am not forcing you to download this. I may update the storage method later on, but for now it can stay.

- Donkey Death Jam

[ThatTrollGuy]

Great work man! Only bad thing that it's not FUD at runtime, despite that still a great job.

EDIT: Tried it out with 3 RATs, worked flawlessly.

[Marshmallow Man]

Great work man! Only bad thing that it's not FUD at runtime, despite that still a great job.

EDIT: Tried it out with 3 RATs, worked flawlessly.

Which is it not fud with in runtime?

[ThatTrollGuy]

Which is it not fud with in runtime?

NJRat, avast deepscreen managed to detect it.

[Donkey Death Jam]

NJRat, avast deepscreen managed to detect it.

Weird, will check that out. I use avast and it didn't detect it, added a delay to get around that.
Edit: Fixed, will update link now.

[ThatTrollGuy]

Now works with all RATs I've tested so far, great work mate! Keep up the good work.

[Marshmallow Man]

Works with babylon 100% fud scantime and passes bitdefender runtime, dont have other antiviruses to test

please test runtime, op is my good friend and you can run this on vm or sandboxxied if you dont trust. we need some antiviruses to pick it up and study how to refud. :)

[ThatTrollGuy]

Tested avast, malwarebytes, nod32, norton and kaspersky. Nothing found so far. Works scantime&runtime 100%.

---

I can't post links here, can you give me your skype or anything in PM?

[abdelhak34]

hi , thank for your posting
can you give another website for scanning ?
because majyx.net always stuck in "pending"

[Donkey Death Jam]

hi , thank for your posting
can you give another website for scanning ?
because majyx.net always stuck in "pending"

https://nodistribute.com/
That'll do fine

[abdelhak34]

vouch this person (y) ! wow man all clean only avast (y)
thank you man

[Fluffy_]

Would you be willing to release the source?
I'm writing my own crypter in c++ and I'm having a few problems, so looking at the source for another crypter might help.

[yotoprules]

Tested on my spare laptop windows 8 njrat slipped right through and working perfectly. hopefully people dont upload to virustotal and get rid of the FUD status.

[hehexd69]

my windows defender keeps deleting it lol

---

can i have the password too

[Marshmallow Man]

Seems people already uploaded to virustotal, dont care! Wont stay here long then.