[bad_c0de]

Screenshots:

Spoiler (Click to View)
Spoiler (Click to View)
Spoiler (Click to View)
Spoiler (Click to View)
Spoiler (Click to View)

About Imperium:

Tired of "crypters" promising good runtime execution rates yet they fail to comply because of overused old injection methods (dynamic forking also called "RunPE") ? Tired of using shared stubs which get detected in ~6 to 24 hours at best ? If so, you're in the right place.
Imperium was initially a private crypter fully coded in C/ASM then it came to our knowledge that most crypters in this forum doesn't comply with their promises and their fancy threads design, so we decided to give a chance to members here to have a taste of a real crypter under reasonable prices for the community(we are aware that most persons here can't afford the C/ASM version). In this view, we decided to make a low budget version by using a .NET loader instead of the C one and switching some evasions techniques to overcome the gap between price and quality.

What we guarantee:

• Completely unique injection method(never used in the field) assuring runtime evasion.
  
• Completely unique stubs(you build your own stub in USG tab).
  
• Small stub size.
  
• Bypassing SSDT hooks(eg. Norton & only AVs based filters) on x86 based machines(no crypter did that til now).
  
• High execution rates.
  
• Refund in case the crypter get caught at runtime by mainstream AVs(Avast, AVG, Bitdefender, KAV, ESET, Norton, TrendMicro, MSE).
  
• Active support.
  

Plans:

• 1 Month usage & Ability to build 2 stubs: $150
  
• 1 Month usage & Ability to build 5 stubs: $280
  
• 3 Month usage & Ability to build 10 stubs: $600
  

Accepted payment methods:

• BTC, ETH, BCH(BitcoinCash) & LTC.
  

Contact us:

• Jabber: [email protected]
  

Scan:
Spoiler (Click to View)[img]http://viruscheckmate.com/image/Bi3Z267o8z1f/full/img.png[/img]


Runtime videos:

Spoiler (Click to View)

• Kaspersky:
  https://www.youtube.com/watch?v=2FLo8vhMzN8
  
  
• ESET:
  https://www.youtube.com/watch?v=DElye3_e5nQ
  
  
• Windows Defender:
  https://www.youtube.com/watch?v=C-b7STzQxu8
  
  
• Avast:
  https://www.youtube.com/watch?v=mHtIHq7uqSA
  
  
• Norton Internet Security:
  https://www.youtube.com/watch?v=LTyDQ_gQtTU
  
  
• 360 Total Security:
  https://www.youtube.com/watch?v=SarSUffgtho
  
  
• Avira Antivirus:
  https://www.youtube.com/watch?v=UJLmMFeGONQ
  
  
• AVG:
  https://www.youtube.com/watch?v=kGpIA-HJzCY
  

[whendarknesscomes]

Can you shoot me a pm with runtime scans?

[bad_c0de]

Can you shoot me a pm with runtime scans?

Runtime scans ? those runtime online scanners aren't even accurate, you can add me on jabber to test with any AV.

[mehtevas]

Runtime scans ? those runtime online scanners aren't even accurate, you can add me on jabber to test with any AV.

why are these online scanners not accurate ?

[bad_c0de]

why are these online scanners not accurate ?

not gonna argue here as i'm not endorsing any service(AVs detections depends on multiple factors like if machines are running on x86 or x64, child processes, cloud options... ), but if you wish to see it in action, you can download any AV and we will gadly test it for you via a remote desktop solution.

[05317832892]

Screenshot shows injecting into svchost. You say you use a .net loader. Which .net framework does the loader target? Does it work with EOF data or .net files? Ring-3 book evasion, is it manual mapping into current process or syscall extraction? What injection technique is this using? Are you fresh spawning svchost and hollowing it or mapping payload PE and side loading into a currently running svchost? Do you provide any anti-emulation? You say coded in ASM/C yet you have a .net loader? Any explanation on why the this is necessary?

Sorry if I come off as aggressive. Your crypter is new on this forum and lacks technical details. PM if you want testing/vouch.

[bad_c0de]

Screenshot shows injecting into svchost. You say you use a .net loader. Which .net framework does the loader target? Does it work with EOF data or .net files? Ring-3 book evasion, is it manual mapping into current process or syscall extraction? What injection technique is this using? Are you fresh spawning svchost and hollowing it or mapping payload PE and side loading into a currently running svchost? Do you provide any anti-emulation? You say coded in ASM/C yet you have a .net loader? Any explanation on why the this is necessary?

Sorry if I come off as aggressive. Your crypter is new on this forum and lacks technical details. PM if you want testing/vouch.

-"Which .net framework does the loader target?"
It targets any version you want.

-"Does it work with EOF data or .net files?"
Works with .NET files, but we don't support EOF since no modern malware use that.

-"Ring-3 hook evasion, is it manual mapping into current process or syscall extraction?"
Usermode hooks are not really needed to be bypassed im my case, but i'm doing it anyway(i map a new ntdll from the disk) and no it's not manual mapping.

-"What injection technique is this using? "
Technique is a mix between basic RunPE and Process Doppelganging(it's compatible with all windows versions in both arch).

-"Are you fresh spawning svchost and hollowing it or mapping payload PE and side loading into a currently running svchost?"
i spawn wermgr by default because it's usually spawned when a crash happens and is signed by Microsoft but it works with svchost too.

-"Do you provide any anti-emulation?"
yeah we do.

-"You say coded in ASM/C yet you have a .net loader? Any explanation on why the this is necessary?"
Answer is on the thread: to make a low budget version, there is a C/ASM version already in sales(not here).

-"Sorry if I come off as aggressive"
Not at all.

-"PM if you want testing/vouch."
We may provide vouch copies but not for now.

[05317832892]

-"Which .net framework does the loader target?"
It targets any version you want.

-"Does it work with EOF data or .net files?"
Works with .NET files, but we don't support EOF since no modern malware use that.

-"Ring-3 hook evasion, is it manual mapping into current process or syscall extraction?"
Usermode hooks are not really needed to be bypassed im my case, but i'm doing it anyway(i map a new ntdll from the disk) and no it's not manual mapping.

-"What injection technique is this using? "
Technique is a mix between basic RunPE and Process Doppelganging(it's compatible with all windows versions in both arch).

-"Are you fresh spawning svchost and hollowing it or mapping payload PE and side loading into a currently running svchost?"
i spawn wermgr by default because it's usually spawned when a crash happens and is signed by Microsoft but it works with svchost too.

-"Do you provide any anti-emulation?"
yeah we do.

-"You say coded in ASM/C yet you have a .net loader? Any explanation on why the this is necessary?"
Answer is on the thread: to make a low budget version, there is a C/ASM version already in sales(not here).

-"Sorry if I come off as aggressive"
Not at all.

-"PM if you want testing/vouch."
We may provide vouch copies but not for now.

Nicely layed out reply, and you gave all the answers I want to hear. You have my vouch.

Your injection method intrigues me. I have seen an interesting implementation of doppelgänger live in the wild, it uses the second half of the traditional PoC, creating the process from the section object, however it’s obtains the section object differently without using the transaction APIs. Maybe similar to your work, I have no idea.

One last thing, for most people, the definition of manual mapping is just that, imitating LoadLibaryA() reading a clean copy of ntdll.dll from the disk and mapping it into memory so the functions can be executed without any hooks, which sounds like what you’re doing.

Regardless, you have my vouch, good luck with sales.

[DexterGO]

use dyncheck for your runtime scan...

hello

https://run4me.net/result/0857447d667e3e...1ca3d5797a

[bad_c0de]

Nicely layed out reply, and you gave all the answers I want to hear. You have my vouch.

Your injection method intrigues me. I have seen an interesting implementation of doppelgänger live in the wild, it uses the second half of the traditional PoC, creating the process from the section object, however it’s obtains the section object differently without using the transaction APIs. Maybe similar to your work, I have no idea.

One last thing, for most people, the definition of manual mapping is just that, imitating LoadLibaryA() reading a clean copy of ntdll.dll from the disk and mapping it into memory so the functions can be executed without any hooks, which sounds like what you’re doing.

Regardless, you have my vouch, good luck with sales.

Thanks for your reply!
you can add me on jabber for more information.

---

hello

https://run4me.net/result/0857447d667e3e...1ca3d5797a

Thanks for buying !
I hope you enjoy it, even though as i said before those online scanners aren't accurate(yeah it's FUD on them, but i still insist on accuracy fact).

[mehtevas]

hello

https://run4me.net/result/0857447d667e3e...1ca3d5797a

scan with internet access on.

[SIM-2212192]

mfw

>too poor to afford $30 dyncheck
>uses a shitty excuse like "its not accurate!" to avoid providing runtime proof

GLWS THOUGH BUDDY!!

dude sick burn

[bad_c0de]

updated with some runtime videos for Avast & ESET & Kaspersky yesterday.
gonna do the rest today.

[mehtevas]

what about CIS (https://www.comodo.com/home/internet-sec...curity.php ) with hips enabled. & 360 Total security ( https://www.360totalsecurity.com/en/ )

[bad_c0de]

what about CIS (https://www.comodo.com/home/internet-sec...curity.php ) with hips enabled. & 360 Total security ( https://www.360totalsecurity.com/en/ )

We tested CIS and as you see, it didn't handled my code correctly in the isolation mode(enabled by default) for native files... we will fix this soon.
For 360, yeah we bypass it.