DO NOT DEAL WITH THIS MEMBER
Jul 14, 2018 08:44 AM
(This post was last modified: Jul 21, 2018 06:14 AM by NYANxCAT.
Edit Reason: v0.3
)
![[Image: 68747470733a2f2f692e696d6775722e636f6d2f...6b2e676966]](https://camo.githubusercontent.com/c8e36f2e943c9702e18711dfb45da22303119444/68747470733a2f2f692e696d6775722e636f6d2f3055355a6b786b2e676966)
I'm Learning about evasion techniques to bypass AV. here's my last simple project. If you have any bug please PM me.
I don't think it will be FUD for more than few days since its public software.
Main Points
.NET Coded in Visual Basic .NET, required framework 4.0 dependency.
USG Adding some junk methods and rename all variables using the Chinese language
Injection Hide payload behind a legit process
Bind Add file to run with your payload runtime
Anti Analysis Stop task manager and Wireshark from analyzing your payload
Anti Virtual Machines Uninstall itself if the machine is virtual to avoid scanning or analyzing
Download
https://www.sendspace.com/file/gvsy2u
To prevent spreading and VT scan, PM for password
In Action
Scan Result + Installation https://avcheck.net/id/m5IvN2ZikDGA
Video bypass NOD32 Runtime https://streamable.com/6wheg
Notes
*This is free and open source project. Please don't ask me for private stub nor setup support.
*Project is already on GitHub, PM for URL
*Bug? Please post down the issue or PM me
Changelog
v0.3
-[Fixed] Mutex
-[Fixed] Large size output
-[Fixed] Building Slow Time
-[Updated] Auto Mode -> Crypters Newbie Friendly
Jul 14, 2018 08:50 AM
(This post was last modified: Jul 14, 2018 08:51 AM by AckroyJR.)
How well does it work with njrat lime v1.7.9?
How well would it do In virustotal?
DO NOT DEAL WITH THIS MEMBER
(Jul 14, 2018 08:50 AM)AckroyJR Wrote: How well does it work with njrat lime v1.7.9?
How well would it do In virustotal?
Yes + Can you PLEASE not scan it in VT
Do we need to un-check everything on the nj before encryp?
DO NOT DEAL WITH THIS MEMBER
(Jul 14, 2018 08:54 AM)ihateitunes Wrote: Do we need to un-check everything on the nj before encryp?
Of course, uncheck RAT settings
Jul 14, 2018 08:56 AM
(This post was last modified: Jul 14, 2018 08:58 AM by AckroyJR.)
(Jul 14, 2018 08:53 AM)NYANxCAT Wrote: Yes + Can you PLEASE not scan it in VT
Should I use the site u used to scan the crypter? If you for some reason would like to help me or talk or give me future updates for this crypter, here's my discord: AckroyJR#7411
(Jul 14, 2018 08:55 AM)NYANxCAT Wrote: Of course, uncheck RAT settings
Do you mean uncheck the stuff like melting the file, disabling task manager, and bypassing UAC?
Jul 14, 2018 08:57 AM
(This post was last modified: Jul 14, 2018 08:58 AM by ihateitunes.)
If i scan on virus total instead of another scanner what happens?
What scanner should we use I don't want to scan it on vt
DO NOT DEAL WITH THIS MEMBER
Jul 14, 2018 09:06 AM
(This post was last modified: Jul 14, 2018 09:07 AM by NYANxCAT.)
(Jul 14, 2018 08:56 AM)AckroyJR Wrote: Should I use the site u used to scan the crypter? If you for some reason would like to help me or talk or give me future updates for this crypter, here's my discord: AckroyJR#7411
Do you mean uncheck the stuff like melting the file, disabling task manager, and bypassing UAC?
These is no updates, it's public crypter. dont use virustotal search for another scan
and yes uncheck everything
(Jul 14, 2018 08:57 AM)ihateitunes Wrote: If i scan on virus total instead of another scanner what happens?
What scanner should we use I don't want to scan it on vt
Search for another scanner, VT send files to anti-virus companies
Jul 14, 2018 09:11 AM
(This post was last modified: Jul 14, 2018 09:13 AM by AckroyJR.)
So I should use the scanner you used for the crypter? Or when you said search for another scanner, you were referring to us using ur scanner instead of virustotal?
I downloaded LimeRAT but whenever I tried to compile it, it wouldn't compile the server part so I couldn't run it. would u mind sending me a download for the compiled version of it please? It won't let me compile the server due to me not having framework 4.0, I got 4.6, I uninstalled all of them and restarted PC, I even unchecked framework 4.6 from the startup.
Can you share the source of it also ?
Thank you.
DO NOT DEAL WITH THIS MEMBER
(Jul 14, 2018 09:17 AM)Astraviruzz Wrote: Can you share the source of it also ?
Thank you.
It's on my github. I don't share it here on HF
Jul 14, 2018 09:26 AM
(This post was last modified: Jul 14, 2018 09:33 AM by AckroyJR.)
Nevermind, found ur post. Ur the man dude. +rep
So this crypter is generally created for LimeRat?
Would this work better with LimeRAT or NJRat Lime Edition?
DO NOT DEAL WITH THIS MEMBER
(Jul 14, 2018 09:26 AM)AckroyJR Wrote: Nevermind, found ur post. Ur the man dude. +rep
So this crypter is generally created for LimeRat?
This should work with any .net rat
Jul 14, 2018 09:37 AM
(This post was last modified: Jul 14, 2018 09:38 AM by AckroyJR.)
(Jul 14, 2018 09:33 AM)NYANxCAT Wrote: This should work with any .net rat
Alright thank you, do you have NJRat Lime Edition 0.8.5 on ur github?
Turns out I only found the LITE version of LimeRAT. :( I mostly care for password stealers tbh. Know where there is a compiled version of it? PC Doesn't let me compile it due to it using framework 4.0 for the server.
quasar gold work with this?
|
