Mar 9, 2022 04:41 PM
(This post was last modified: Mar 9, 2022 04:43 PM by benio.)
Alright im going to save you time and money.
1. If a crypter is using registry key persistence it will not bypass WD at runtime, do not touch it with a 10ft pole.
2. If the crypted file is dropping itself to disk after its run, then it will get detected by WD behavioral analysis. Your dropped file must be signed with a trusted signature.
3. If the crypter does not have AMSI solution then you will probably get decked at runtime.
Say it does bypass it for a few hours. After distribution, the dropped file will get caught by WD.
In 2022, the crypter must use a fileless technique or you must perform DLL hijacking to get a true bypass. Your persistence must also be unique like WMI event subscription. The main .exe must not have the dropper code inside it, it will get caught even when obfuscated. The .exe must be a shell that holds the dropper code inside it. Most of these skids have no clue how to code something complex enough to bypass AV in 2022 for more than a few hours. Just a little rant after I looked at the marketplace here.
Do not believe the bullshit scan results either, in 2022 most AV's detect behavior. I cannot believe some of these skids are selling a GUI for 75-150$ a month marketing it as a crypter. What if I jump on here and sell you guys an actually working product can i charge 500?
1. If a crypter is using registry key persistence it will not bypass WD at runtime, do not touch it with a 10ft pole.
2. If the crypted file is dropping itself to disk after its run, then it will get detected by WD behavioral analysis. Your dropped file must be signed with a trusted signature.
3. If the crypter does not have AMSI solution then you will probably get decked at runtime.
Say it does bypass it for a few hours. After distribution, the dropped file will get caught by WD.
In 2022, the crypter must use a fileless technique or you must perform DLL hijacking to get a true bypass. Your persistence must also be unique like WMI event subscription. The main .exe must not have the dropper code inside it, it will get caught even when obfuscated. The .exe must be a shell that holds the dropper code inside it. Most of these skids have no clue how to code something complex enough to bypass AV in 2022 for more than a few hours. Just a little rant after I looked at the marketplace here.
Do not believe the bullshit scan results either, in 2022 most AV's detect behavior. I cannot believe some of these skids are selling a GUI for 75-150$ a month marketing it as a crypter. What if I jump on here and sell you guys an actually working product can i charge 500?
