[Jean-Jacques Rousseau]

Hey.

Yesterday I decided to code a crypter (for the lols of it), and I just finished the base. In this thread I will post my progress when developing this cryper.

Small details:
- Written in Visual C/C++ and x86_32 ASM.

Current features:
- Encryption/Decryption routine in x86_32.
- Malware is stored using the resource method.
- Malware is dropped to disk after decryption.

I was honestly expecting it to be fully detected when I first scanned it, however, it showed up as 11/32 scantime.

i.gyazo. com/ f227be7035813a8c5b5ea36733939830.png
This is Gaudox crypted. The stub is compiled to debug - it has not been stripped.

What i am aiming for in the near future:
- Unique RunPE
- Changing the decryption routine to something like Luminous crypter, to mess upp the emulators
- Call the functions dynamically, bypass some hooks.

My end-goals:
- Calling the functions via syscalls for both x86_64 and x86_32 (still researching about the 0x33 segment!)
- Some Anti-debug/Anti-VM features.

The crypter is called Gasolyne. I dont know what I will do with it - might sell or release.

I am open to learning!

EDIT: A word.

---

To clarify for those who dont know how the Luminous crypter works, I will essentially brute-force key.

[3DES]

Calling APIs dynamically wont do jack shit dude if you are trying to bypass with that. Preferably read syscall numbers from ntdll and use them to bypass hooks.

[Jean-Jacques Rousseau]

Calling APIs dynamically wont do jack shit dude if you are trying to bypass with that. Preferably read syscall numbers from ntdll and use them to bypass hooks.

Yeah, that’s why I wanted to use direct syscall, but I havent really ”mastered” the topic yet.

[3DES]

You also might want to use LoadPE instead of runpe(ITS ANCIENT!)

[int]

dropping the malware executable removes the entire point of running in memory

[Jean-Jacques Rousseau]

dropping the malware executable removes the entire point of running in memory

Lol, it was just the base, to make sure everything went fine. I am not a retard.

---

You also might want to use LoadPE instead of runpe(ITS ANCIENT!)

It sure is, will add that in the end.

[Uiqueblhats]

Mate can you pm me the link to luminous crypter heard a lot of good stories about it

[Jean-Jacques Rousseau]

Mate can you pm me the link to luminous crypter heard a lot of good stories about it

I cant pm. The crypter has been posted on a load of forums (including this one) multiple times.

[Uiqueblhats]

I cant pm. The crypter has been posted on a load of forums (including this one) multiple times.

Post the link here only please

[Jean-Jacques Rousseau]

Post the link here only please

showthread.php?tid=5722311

[Uiqueblhats]

showthread.php?tid=5722311

thanks mate it will really help me

[Jean-Jacques Rousseau]

thanks mate it will really help me

Happy coding!

---

Update: trying to implement a runpe, having some issues. The code looks just fine, however, my test file does not execute. Will look at other sources to see how they do it.

[Twistd]

What exact part of your crypter is assembly?

[Jean-Jacques Rousseau]

What exact part of your crypter is assembly?

The encryption/decryption routine, and soon, the syscalls (that will replace functions).

---

UPDATE: Implemented a RunPE, code gets executed. Everything looks fine!

New scan!

4/32
i.gyazo .com/ 8b1aaf859b39ea5eebc28c55dc26067b.png

---

I will add an anti-emulation method that Luminous invented. Hopefully it can bypass AVs runtime.

[Twistd]

The encryption/decryption routine, and soon, the syscalls (that will replace functions).

---

UPDATE: Implemented a RunPE, code gets executed. Everything looks fine!

New scan!

4/32
i.gyazo .com/ 8b1aaf859b39ea5eebc28c55dc26067b.png

---

I will add an anti-emulation method that Luminous invented. Hopefully it can bypass AVs runtime.

That will replace api calls you mean? I don't see any specific reason why you would want to use assembly for the encryption/decryption routine. Please elaborate

Anti emulation won't bypass anything runtime.