[Praet0rian]

I've been curious and I can't seem to find an answer to this question, does it matter if you dynamically link the functions you want or statically link them when it comes to anti viruses detecting them? for example, if I wanted to use Qt's classes on a malware, would it be better to statically link or dynamically link?

first thread in this forum, after being here for 2 weeks and got a a lucky clover :)

[Zyklon A]

It doesn't matter! AVs have callbacks on certain functions and based on that they determine if your file is malicious. It doesn't matter if you call the function dynamically, well it does if you want to make your file undetected at scantime but you would need to encrypt/obfuscate/encode the function name/s.

[Praet0rian]

It doesn't matter! AVs have callbacks on certain functions and based on that they determine if your file is malicious. It doesn't matter if you call the function dynamically, well it does if you want to make your file undetected at scantime but you would need to encrypt/obfuscate/encode the function name/s.

interesting, but how would I use the libraries I want then? but surely they cannot thing that because I use a 3rd party lib called QT then it is most likely malware, tons of programs use QT, most of them are legitmate, what would you suggest? I would prefer the functions being statically linked because then it will be far less messier, all-in-one payload

[Zyklon A]

interesting, but how would I use the libraries I want then? but surely they cannot thing that because I use a 3rd party lib called QT then it is most likely malware, tons of programs use QT, most of them are legitmate, what would you suggest? I would prefer the functions being statically linked because then it will be far less messier, all-in-one payload

Why would you use QT to develop a malware? Dont use third party libs, they just make your malware bloated.

[0xDEAD10CC]

Furthermore, why would you need Qt? It's mainly a GUI framework... Are you intending to do give the end user a nice UI element for your malware that they most likely don't want on their PC? 🤦‍♂

Good luck with small filesize when linking Qt statically too, you'll be in the Mb range without a doubt.

[maldev0]

try to avoid standard c libs and implement the essential functions (memcpy/memset) on your own, which is not hard.
u can create a custom GetProcAddress function in order to dynamically call the api's, in a "stealth" way. You'll need to understand how the PE structure works, that's an easy task.

[Praet0rian]

Furthermore, why would you need Qt? It's mainly a GUI framework... Are you intending to do give the end user a nice UI element for your malware that they most likely don't want on their PC? 🤦‍♂

Good luck with small filesize when linking Qt statically too, you'll be in the Mb range without a doubt.

I'm mostly interested in crypto and networking, Qt was merely an example

[morph]

I would statically link all libraries so it's just one file.

[Praet0rian]

Furthermore, why would you need Qt? It's mainly a GUI framework... Are you intending to do give the end user a nice UI element for your malware that they most likely don't want on their PC? 🤦‍♂

Good luck with small filesize when linking Qt statically too, you'll be in the Mb range without a doubt.

Also, I don't think size will be a problem, UPX has compression rate of about 70% or so...

[0xDEAD10CC]

Also, I don't think size will be a problem, UPX has compression rate of about 70% or so...

If size was always unimportant, then good luck with lots of code injection methods and UPX.

If you're unlucky enough to end up with a size like what this guy had: http://stackoverflow.com/q/25426895/6264524 160MB.. 70% doesn't mean a whole lot anyways.

[Praet0rian]

If size was always unimportant, then good luck with lots of code injection methods and UPX.

If you're unlucky enough to end up with a size like what this guy had: http://stackoverflow.com/q/25426895/6264524 160MB.. 70% doesn't mean a whole lot anyways.

ahaha holy shit, poor fella

but yeah I don't intend to use Qt anyway, like I posted above: it was merely an example.

I need to use networking and cryptography classes in C++ for a virus [educational purposes of course :)], so I was wondering if this was going to be a problem, the standard shit you get with windows with Winsock is annoying, especially if I want to make a server, plus encryption is a big deal, I tried using OpenSSL but after trying it it has tons of memory leaks and it's in C...

[Zyklon A]

ahaha holy shit, poor fella

but yeah I don't intend to use Qt anyway, like I posted above: it was merely an example.

I need to use networking and cryptography classes in C++ for a virus [educational purposes of course :)], so I was wondering if this was going to be a problem, the standard shit you get with windows with Winsock is annoying, especially if I want to make a server, plus encryption is a big deal, I tried using OpenSSL but after trying it it has tons of memory leaks and it's in C...

Just use WINAPI. Windows has the cryptoapi that you can use and ditch the OpenSSL.
Also C++ is an overkill for malware, just stick with C. All WINAPI is made for C.

This is if you are targeting windows.

[0xDEAD10CC]

^ Not necessarily if you want cross-platform. WinAPI isn't. If you're on Windows though you can use WinInet or WinHTTP, in addition to the Crypto API. You can reduce binary size by avoiding CRT and using Windows functions.

https://support.microsoft.com/en-us/help...-functions

[Praet0rian]

^ Not necessarily if you want cross-platform. WinAPI isn't. If you're on Windows though you can use WinInet or WinHTTP, in addition to the Crypto API. You can reduce binary size by avoiding CRT and using Windows functions.

https://support.microsoft.com/en-us/help...-functions

Yes I know of thet CRT trick, did it once and got down to a few kilobytes most of the program was just filled with 0 bytes padding and I couldn't manage to remove it , now I don't know much about this part, but won't removing CRT also remove some features that protect the program from attacks like cookies? talking about Visual Studio, I know to "ignore default library" and use the other entrypoint that's called winCRTmain or something like that.

---

Just use WINAPI. Windows has the cryptoapi that you can use and ditch the OpenSSL.
Also C++ is an overkill for malware, just stick with C. All WINAPI is made for C.

This is if you are targeting windows.

I would like to stick with C++ because of the OOP, maintaining a large project, for me at least, is much easier in OOP then in C.

I know that there are some networking libraries that make communication much simpler and some even come with encryption, so I can focus on the other aspects of the program rather then
re-inventing the wheel, which is why I am asking this question.

[Qmz_]

Try both and test on a VM, runtime and scantime. That's the way to test it, if you don't know, or find the answers.

When done, post here the results. :)