[Hypnotist]

Most of you are probably going to say "windows defender is easy to bypass" no, not anymore. It really isn't. I've tried all the paid Crypters and most Crypters get detected by Mircrosoft runtime which obviously everyone has.

I've discovered a way around it. It requires using a different RAT and converting the exe to a .js file and obfuscating the javascript.

Someone showed me this earlier and this is going to help me big time. I've tested my bots that I couldn't download and execute anything on before and it's working. So if you're having the same issue where your RAT does not execute and you need to move them around, use this.


REVENGE RAT
Spoiler (Click to View)Which is also a very nice RAT, however it doesn't have reverse proxy.

Download: https://www.connect-trojan.net/2016/12/r...oleon.html

vSupreme Crypter v0.2

Download: https://www.connect-trojan.net/2017/03/v...v.b01.html

When you have converted your exe to a js file open the js file in notepad and add this.


You can easily make your .js output FUD by obfuscating the javascript.
https://www.danstools.com/javascript-obf.../index.php
https://obfuscator.io/

Hope this helps someone. It's also a free way to spread a FUD (or however undetected you can get it) RAT so I thought I'd share this.

Credit to: https://hackforums.net/member.php?action...id=1175356

Let me know what you guys think about this and if it helps you.  🤝

[R4NS0M]

Wow Nice Tutorial can you use another RAT like IM5?

[opsplayer]

Can you upload the files to another host provider? Can't seem to get the crypter.

Is the rat n crypter both necessary or can we just obfuscate the rat output alone?

[Hypnotist]

Wow Nice Tutorial can you use another RAT like IM5?

I don't think it will work with another RAT. Let me know if you try though. 🤝

[Goldmouth]

Whoa.. great thread. Will test a report back. Thank you.

[MikeHunt2016]

Thanks to OP for this thread. Keep up the good work mate
M.H

[Angelis]

Can confirm this method works.

Java is not executed the same method as executable's in Windows environments. Thus bypassing many existing security checks.

Nice write up OP. Thanks for sharing.

[NYANxCAT]

I don't think it will work with another RAT. Let me know if you try though.  🤝

Great work m8 yeah PowerShell is good for bypass some AV and windows def, I will test it later. I think it would work with LimeRAT and AsyncRAT, maybe even njRAT.

[Hypnotist]

Great work m8 yeah PowerShell is good for bypass some AV and windows def, I will test it later. I think it would work with LimeRAT and AsyncRAT, maybe even njRAT.

You're right, it does work with njRAT! Know any RAT's with reverse proxy it would work with? Would be helping me a great deal.

[NYANxCAT]

You're right, it does work with njRAT! Know any RAT's with reverse proxy it would work with? Would be helping me a great deal.

You should try QauasarRAT

[no$fer7u]

Do you think this will work on QuasarRat?

[Hypnotist]

You should try QauasarRAT

Doesn't work unfortunately. Thanks though. ✌

---

Do you think this will work on QuasarRat?

Tested, no it doesn't.

[no$fer7u]

Doesn't work unfortunately. Thanks though.  ✌

---

Tested, no it doesn't.

Damn haha gonna test it on Orcus if this works

[CyberStrike]

So yes SquiblyDoo has been known since 2016 xml/js are loved by powershell. Seems that it does a hexdump of the executable then proceeds to base64 encode it hence the "TVqQAAMAAAAEAAAA"

echo "TVqQAAMAAAAEAAAA" | base64 -d
MZ�

It's dropping to disk try to run in memory, give DotNetToJscript a look providing that the payload is in dotnet. Either way good stuff, tradecraft is important. I believe this still should be in powershell logs.. deobfuscated.

https://www.carbonblack.com/2016/04/28/t...-the-land/

[***W0lf***]

Most of you are probably going to say "windows defender is easy to bypass" no, not anymore. It really isn't. I've tried all the paid Crypters and most Crypters get detected by Mircrosoft runtime which obviously everyone has.

I've discovered a way around it. It requires using a different RAT and converting the exe to a .js file and obfuscating the javascript.

Someone showed me this earlier and this is going to help me big time. I've tested my bots that I couldn't download and execute anything on before and it's working. So if you're having the same issue where your RAT does not execute and you need to move them around, use this.


REVENGE RAT
Spoiler (Click to View)Which is also a very nice RAT, however it doesn't have reverse proxy.

Download: https://www.connect-trojan.net/2016/12/r...oleon.html

vSupreme Crypter v0.2

Download: https://www.connect-trojan.net/2017/03/v...v.b01.html

When you have converted your exe to a js file open the js file in notepad and add this.


You can easily make your .js output FUD by obfuscating the javascript.
https://www.danstools.com/javascript-obf.../index.php
https://obfuscator.io/

Hope this helps someone. It's also a free way to spread a FUD (or however undetected you can get it) RAT so I thought I'd share this.

Credit to: https://hackforums.net/member.php?action...id=1175356

Let me know what you guys think about this and if it helps you.  🤝

I'm glad i could help you! 🤝 🤝 🤝