[gigajew]

Cleardrop Crypter, a project I've thrown together from some code I've wanted to experiment with. It's got built-in protection, light obfuscation (renaming), some slight USG and more. I'm not held responsible for how you use this experimental tool. It wasn't built to hack people's computers, it was built to see if it withstands public testing. I'd appreciate if you post in this thread if any errors occur, if you have any problems with anything, etc. By downloading, sharing, copying, using or otherwise modifying this software you agree to not use it for any illegal purposes. This is a software that is capable of generating malware, and it is illegal to use it, or any software produced by it on any devices or property that you do not own.

It does NOT support:

• EOF
  
• 64-bit based applications
  
• Automatic startup (because it's not really meant for spreading or infecting people)
  

It DOES support:

• 32-bit based assemblies
  
• .NET and native assemblies
  

Features (if you didn't read above)

• Light obfuscation
  
• Light anti-virtualization
  
• Anti-emulation
  
• Anti-debugging
  
• Custom cryptography method
  
• Ability to choose a custom stub (in case of updates, or alternative stubs)
  

It's currently 7/66 as of 02/13/2018, and I'm interested to see how the detection rate develops as more people try it out, submit samples and what not.

Download project: https://files.catbox.moe/wb9s2b.7z (password: gigajew)
Scanned stub: https://www.virustotal.com/#/file/43dd57.../detection

[Smileツ]

Thanks for the crypter , i will try for sure.
It's .net ?

[gigajew]

Thanks for the crypter , i will try for sure.
It's .net ?

The crypter and stub are .NET Framework version 4.0. I've tested both native and managed executables and they both run. Works well with Quasar actually.

[Smileツ]

The crypter and stub are .NET Framework version 4.0. I've tested both native and managed executables and they both run. Works well with Quasar actually.

Possible to add 2.0 too so i try to bind them ?

[Adlies]

Thanks for this free cryptor, I'll give it a test now

[gigajew]

Delaying release, wait for more information

[Vagabundo Legendario]

I would like to test it thanks

[Arkane21]

Hey I want to test this and scan on virus checkmate.

Thanks,

Arkane21

[Takehito Morokuzu]

I can test this for you, is it runtime UD? Also if I get this can I spread it or just test for you?

[gigajew]

Released again. And to answer your question, it is illegal to spread or execute malware on any devices you do not own, or have consent from the rightful owner of. I'll leave it at that.

As for .NET 2.0 here's a legacy stub that you can use: https://files.catbox.moe/0ohcet.7z (password: gigajew)

[Takehito Morokuzu]

Released again. And to answer your question, it is illegal to spread or execute malware on any devices you do not own, or have consent from the rightful owner of. I'll leave it at that.

As for .NET 2.0 here's a legacy stub that you can use: https://files.catbox.moe/0ohcet.7z (password: gigajew)

Yes I already knew that. But that's what a crypter is designed for. If it's what some people say "protecting your binary" well that's not true because most crypters include malicious function and they get detected by antiviruses after a while anyway which defeats the purpose because people are going to think it's malware even if it's not.

---

It's not working, it says The application was unable to start correctly 0xc0000005 on the crypted file

[gigajew]

Yes I already knew that. But that's what a crypter is designed for. If it's what some people say "protecting your binary" well that's not true because most crypters include malicious function and they get detected by antiviruses after a while anyway which defeats the purpose because people are going to think it's malware even if it's not.

---

It's not working, it says The application was unable to start correctly 0xc0000005 on the crypted file

That’s a bug in the runpe, it happens because you’re supposed to have a delay in a runpe at a certain part, but this one is shellcode so I wouldn’t know how to add one to it. You’ll see the same problem with almost all other runpes. All you can do is just start it again

[Takehito Morokuzu]

That’s a bug in the runpe, it happens because you’re supposed to have a delay in a runpe at a certain part, but this one is shellcode so I wouldn’t know how to add one to it. You’ll see the same problem with almost all other runpes. All you can do is just start it again

Ah it's working now, just didn't work the first time.

[gigajew]

If anyone wants to make graphics or UI for it I wouldn’t mind adding it

[SIM-2294117]

Love it! Detection ratio of 2/64, very well made for something that's free!