[squidward1337]

Hello,

Im currently writing a crypter in c#.
It is FUD by now in 99% of the crypts.
But my persistance method is detected as Trojan by Defender: Win32/Bearfoos.B!ml or Behavior:Win32/Persistence.A!ml.
If i don't include persistance it is fud.

Im dropping a Powershell script which is copying the .exe into a folder and adds an entry to Run Registry KEY and than deletes itself.
During runtime it is undetected and executes.
But Defender later catches it with both detections above and also catches the copied file as soon as a restart is done.
Does anyone know a good persistance method (that does NOT require admin)?
Or someone knows what I can do to prevent these detections?
Harmless programms also add themselfes to Run Key so I dont understand why it is detected.
Dropping to Startup folder has same detections btw.

Thanks for help

[Frost Crypt]

why are you dropping the powershell script, you could execute powershell commands directly from c# without any drop including your registry key.
That could be the reason of the detection.

[squidward1337]

why are you dropping the powershell script, you could execute powershell commands directly from c# without any drop including your registry key.
That could be the reason of the detection.

First i did not and executed everything in Executable. Tryed it with PS Scripts to have another process execute the persistance to avoid having Assembly.Load and Persistence in the same file. Thought that could be the cause of the detection. So same result with doing it in executable.

---

Thanks shatter. This may help!

[【ＢＡＤＭＡＮ】]

https://github.com/mandiant/SharPersist

Most of these require admin , also they are detected.

I have seen lot of persistence methods recently which also require admin but they are probably not detected by wd (havent tested all of them).

What i personally use is some variant of dll proxy load for programs that already use startup.

[【ＢＡＤＭＡＮ】]

here's an idea

execute in memory!

It doesnt matter, you will get flagged after system reboot even if success to pass your file to startup at first execution.

Task scheduler , Registries and Services are monitored.