[DeluxeSoftware]

Obviously it's his crypters fault.. If he uses a crypter that bypasses it then no anti mem scan is needed, but making it impossible for scanner to scan it will also bypaass it

Stop, just stop. Like you have no idea what you are talking about and you posted 32 posts today.. Jesus, you are posthunting as hell.

[Miss_intengible]

Don't listen to the other guys. Like yes, it is your crypters fault but it has nothing to do with anti memory scan.

I just tested that by loading netwire into memory without any anti mem scan and I got no detection.

You loaded the netwire into memory only? or you started execution of netwire in memory too ?

[DeluxeSoftware]

You loaded the netwire into memory only? or you started execution of netwire in memory too ?

haha, I injected it and ran it of course

[Miss_intengible]

Itself? or in another process ?

[moufmouf]

I have used DarkEye in Past, found it best crytper for Netwire, as it gave FUD without any error.

but haven't used it for past few months, don't know if it bypass avast or not

im trying to buy it and use it with my netwire but the support always answer me that the crypter not builded for this things
is it can bypass avast and not detected as alexa or samthing like that
and is it fud or i have to do samthing else to get it fully fud

[Dark.Shadow]

haha, I injected it and ran it of course

Inject itself or in some other process?

I have seen reputed softwares bypassing Avast behavior shield, and doesn't even trigger any detection. so will it work if injected into some other process or?

[Dark.Shadow]

How does Certified apps bypass this Shield? like I have downloaded basic apps from Filehippo or Cnet, and They aren't detected by Avast.

Is it because of certificate or signature?

[Tsukiri]

How does Certified apps bypass this Shield? like I have downloaded basic apps from Filehippo or Cnet, and They aren't detected by Avast.

Is it because of certificate or signature?

Because they arent malicious?

[Dark.Shadow]

Because they arent malicious?

How they know its not malicious? due to signature or?

Because both requires net connectivity and open port to download the data for further installation

[Tsukiri]

How they know its not malicious? due to signature or?

Because both requires net connectivity and open port to download the data for further installation

You dont seem to get it. An Anti-Virus analyzes the program from malicious content and checks whether it tries malicious things (for example if it keeps writing to a .txt file then it's probably a keylogger and an anti-virus can recognize that).

If a program doesn't try anything sketchy which can trigger the anti-virus as malicious, nor does it contain any code that could be flagged as malicious, then why would the AV want to remove it?

[Heresys32]

Inject itself or in some other process?

I have seen reputed softwares bypassing Avast behavior shield, and doesn't even trigger any detection. so will it work if injected into some other process or?

[kevy42]

Inject itself or in some other process?

I have seen reputed softwares bypassing Avast behavior shield, and doesn't even trigger any detection. so will it work if injected into some other process or?

nope, its scanning the memory, to avade avast ud need a private Runpe + native payload encryption + anti-memroy scanner.

[nathanmark]

IDP.ALEXA.51 is indeed a detection which is generally associated with “SeaMonkey”, “Plants vs. Zombies” or other video games. It is confirmed that the observed object originates from .tmp or .exe files in separate Windows directories, such as percent AppData percent and percent temp percent. Given researchers’ false-positive findings, it is normally recognized as ransomware by AVG and confirmed to be potentially harmful to infected computers.