[Codefuser]

Sonya Crypter is a crypter written in AutoIt. The focus of Sonya Crypter is having a strong USG algorithm and FUD results. Currently I am using a RunPE written in AutoIt (No shellcode or public RunPE) which is Runtime UD (a few AV detect it, I will try some other methods to achieve fully FUD runtime result soon, especially the Map/Unmap method which doesn't remove the original image from memory). Dynamic RunPE will also be added which detects which AV is running and choose the appropriate RunPE to bypass it.

What I am working on:

• USG (String Encryption is the only thing left)
  
• Persistence
  
• Cloud Based Stub Builder
  
• A GUI
  
• Anti Memory Scanner (almost done, it will be in a shellcode)
  

USG features:

• Junk code generator
  
• Junk function generator
  
• String encryption
  
• String masking (Using Chr with math generation algorithm)
  
• Flow Obfuscation (Then main trick, creates 95% different stubs not counting the interpreter)
  
• Customizeable stub
  
• UPX or not UPX
  

Other features:

• Persistence (both self and injection, using a combination of Watchdog and a few other private methods)
  
• Attempt to bypass UAC using Wusa method (maybe it won't be implemented, I have only started testing this concept a few days ago)
  
• .NET support
  
• Store data as Resource or EOF data
  
• Sleep
  
• Custom injection
  
• Anti Mem Scan
  
• Dynamic injection, injects into a different process if the one injected into is killed
  
• Binder
  
• Anti emulation
  
• AV Disabler (maybe...)
  

Current scan: NoDistribute.com/result/image/mSrsLMp51P8U7lu4gQXjKNiEhwBq.png
please someone post this as an image for me.


Private Stub also possible as I am only adding resource/EOF data to the stub when crypting it.
Videos bypassing AVs on runtime will be created soon, I just need to tweak and work with the USG some more.

Hoping to see more suggestions and ideas from you, also for pricing as well.

My skype is hiddenintelligence, add me if you have questions. Don't ask about sales, I got a beta tester already

Screenshots Spoiler (Click to View)
Stub Builder

[Armitage]

if you can really code in ASM, why do you use AutoIt in such thing ??

[Codefuser]

if you can really code in ASM, why do you use AutoIt in such thing ??

First of all, I never said I could code in ASM. I can read some though, only started that language a short while ago
Secondly, I am using AutoIt since a very strong USG could be implemented for it. Stub in C++ might be considered at a later date.

[MrKebab]

First of all, I never said I could code in ASM. I can read some though, only started that language a short while ago
Secondly, I am using AutoIt since a very strong USG could be implemented for it. Stub in C++ might be considered at a later date.

Wardow's crypter disappears because he got banned.
Then this "new" person appears with the same stuff
🤩

[FunctionDev]

Wardow's crypter disappears because he got banned.
Then this "new" person appears with the same stuff
🤩

Good find.

[Armitage]

First of all, I never said I could code in ASM. I can read some though, only started that language a short while ago
Secondly, I am using AutoIt since a very strong USG could be implemented for it. Stub in C++ might be considered at a later date.

"Anti Memory Scanner (almost done, it will be in a shellcode)"
you can code shellcode but you can't code in ASM right ?
can you explain me what is a memory scanner ? i always see this shit here.. lol

[Fluffy_]

Wardow's crypter disappears because he got banned.
Then this "new" person appears with the same stuff
🤩

I don't think it's wardow. For one, he's on vacation or something, and right before he was exiled, he implemented a c-shellcode stub that replaced the autoit one.

However, the native stub got detected rather quickly, so he may have rolled it back. Hm, it might actually be wardow.

EDIT: I just remembered that wardow was showing me a new way of obfuscating strings with "String masking (Using Chr with math generation algorithm)". Yep, it's Wardow.

[MrKebab]

I don't think it's wardow. For one, he's on vacation or something, and right before he was exiled, he implemented a c-shellcode stub that replaced the autoit one.

However, the native stub got detected rather quickly, so he may have rolled it back. Hm, it might actually be wardow.

Ofcourse its wardow, just look through his posts and compare pattern and crypter progress :) I don't even know him and i spotted this instantly.

[Codefuser]

"Anti Memory Scanner (almost done, it will be in a shellcode)"
you can code shellcode but you can't code in ASM right ?
can you explain me what is a memory scanner ? i always see this shit here.. lol

Memory scanner scans memory the way the scan files. So without it the moment you put the decrypted stub in memory, it is detected

And who is Wardow? Link me

[Armitage]

Memory scanner scans memory the way the scan files. So without it the moment you put the decrypted stub in memory, it is detected

And who is Wardow? Link me

lol nice story, have a good day.

[Fluffy_]

Memory scanner scans memory the way the scan files. So without it the moment you put the decrypted stub in memory, it is detected

And who is Wardow? Link me

Very funny. I don't believe that you're allowed to have multiple accounts, especially after you were banned.

EDIT: Reported for profile violation.

[MrKebab]

Very funny. I don't believe that you're allowed to have multiple accounts, especially after you were banned.

EDIT: I just remembered that wardow was showing me a new way of obfuscating strings with "String masking (Using Chr with math generation algorithm)". Yep, it's Wardow.

Yuuuuuuup, busted.
+1

[Codefuser]

Very funny. I don't believe that you're allowed to have multiple accounts, especially after you were banned.

Are you talking about hackforums.net/member.php?action=profile&uid=1810243 ?
I have just looked at his anti emulator and it is different than mine (even though it looks fairly interesting, might try that once I have finished ASM). Mine uses heavy calculation and stuffs like that to have a realistic delay.

Edit: and based on his thread, he is using C and not autoit?

[Fluffy_]

Are you talking about hackforums.net/member.php?action=profile&uid=1810243 ?
I have just looked at his anti emulator and it is different than mine (even though it looks fairly interesting, might try that once I have finished ASM). Mine uses heavy calculation and stuffs like that to have a realistic delay.

Edit: and based on his thread, he is using C and not autoit?

Come on man, you were telling me about trying to figure out how to do an anti-emulator in asm by calculating primes or something like that. We all know that you're wardow.
And he switched to autoit to c, but you would know that.

[Codefuser]

Come on man, you were telling me about trying to figure out how to do an anti-emulator in asm by calculating primes or something like that. We all know that you're wardow.
And he switched to autoit to c, but you would know that.

I am doing that in AutoIt?

Code

    $i = 0
$nums = NULL
$to = Random(10000, 90000, 1)
Do
    $f = ChrW(34)
    $i += 1
    If _isprime($i) Then[/php]
        $nums &= "j" & $i
    EndIf

Until $i = $to
$exp = StringSplit($nums, "j")
$f_num = $exp[Random(15, 25, 1)] & Random(1500, 2500, 1)

$f_num_2 = $exp[Random(1, 14, 1)] & Random(1500, 2500, 1)
$f_num_4 = Random(1500, 2500, 1)
$sin = $f_num_4^2
$f_num_5 = $sin^3

Please, stop attacking me. I joined this forums hoping to sell my product here and a few minutes after some people started saying that I violate forums rule. I assure you I have read the Help Doc and have not violated a rule here during the few hours that I were here. Please someone tell staff to check my IP against Wardow.
and also if I am correct, Profile Violation only covers putting offensive/religious/political sutffs in your profile, not muti accounting.


And based on what Wardow said, his anti emulator allocates memory to break them only, not doing calculations and maths.