[Dark.Shadow]

I am using a .Net RAT, but recently faced a new detection by Avast Behaviour Shield. IDP.ALEXA.51.

Stub has bypassed avast deep Screen also but get detected by behavior.


Any idea what this detection really is, as according to web, its false positive many time, but it represents backdoor Trojan.


faced this detection with native crypter of C++ for Netwire also.

[alaintenaho]

since 2 months now.. Welcome to AVAST

[DeluxeSoftware]

That's a detection of the AVG engine. I guess, it's mainly triggered by injections.

[moufmouf]

did u tried darkeye
because i wanna buy it and i dont want to get IDP.ALEXA.51

[Dark.Shadow]

did u tried darkeye
because i wanna buy it and i dont want to get IDP.ALEXA.51

I have used DarkEye in Past, found it best crytper for Netwire, as it gave FUD without any error.

but haven't used it for past few months, don't know if it bypass avast or not

[Cyber Coder]

this detection needs native rat + anti memory scanner

[xcrafter245]

this detection needs native rat + anti memory scanner

want do you mean?

[DeluxeSoftware]

this detection needs native rat + anti memory scanner

Bullshit. It's not triggered by the file being .NET or native... 🤦‍♂

[Cyber Coder]

Bullshit. It's not triggered by the file being .NET or native... 🤦‍♂

huh?anti memory scanner works only with native files so you need a native rat and an anti memory scanner to bypass it;) heard it might work with .net by using reflection instead of runpe but never tried

[Tsukiri]

I'd take Cyber Coders advice, he atleast seems to know what he is talking about.
Grab yourself netwire and (code) a crypter with an anti mem scan function and you should be good.
I'd still say that even if you crypt a file beyond recognition, if it is some shitty malware then this behaviour shield will still pick it up as malicious because
certain hooks / actions it performs, which are recognized by Avast.

[Dark.Shadow]

I'd take Cyber Coders advice, he atleast seems to know what he is talking about.
Grab yourself netwire and (code) a crypter with an anti mem scan function and you should be good.
I'd still say that even if you crypt a file beyond recognition, if it is some shitty malware then this behaviour shield will still pick it up as malicious because
certain hooks / actions it performs, which are recognized by Avast.

anyway to bypass this shield, when am using Netwire Rat?

[Tsukiri]

anyway to bypass this shield, when am using Netwire Rat?

Get a good crypter with antimem scan or an undetected injection method. Aka, a private runPE which bypasses Avast.

[Dark.Shadow]

Get a good crypter with antimem scan or an undetected injection method. Aka, a private runPE which bypasses Avast.

antimemory scan will bypass the behavior shield?

[DeluxeSoftware]

antimemory scan will bypass the behavior shield?

Don't listen to the other guys. Like yes, it is your crypters fault but it has nothing to do with anti memory scan.

I just tested that by loading netwire into memory without any anti mem scan and I got no detection.

[Tsukiri]

Don't listen to the other guys. Like yes, it is your crypters fault but it has nothing to do with anti memory scan.

I just tested that by loading netwire into memory without any anti mem scan and I got no detection.

Obviously it's his crypters fault.. If he uses a crypter that bypasses it then no anti mem scan is needed, but making it impossible for scanner to scan it will also bypaass it