[Neik111]

Hey Guys,

I have a problem with startup of my exe.

Its completly fud, but when i use a reg key for startup it gets detected.

Startupfolder also gets detected.

How can i avoid this or use another technique?

[osn64698]

Nobody will share his own method, but you can start by using .bat/.vbs files etc.

[DramaKing]

Need to know the AV in question. These are legitimate ways to run apps at startup, so it's hard to say.

[gangushbo]

which av? watchdog tried?

[neonbytes]

maybe you can use an intermediate lolbin to create it for your malware
trojan > lolbin > create reg key
this could detatch the action from your malware

[Neik111]

maybe you can use an intermediate lolbin to create it for your malware
trojan > lolbin > create reg key
this could detatch the action from your malware

Yea i tried this, setting the key is undetected, just when you reboot, then its detected

[Wacatac]

Yea i tried this, setting the key is undetected, just when you reboot, then its detected

Because your malware that you're trying to put on startup is detected, not the LOLBIN.

[NyQuil]

Because your malware that you're trying to put on startup is detected, not the LOLBIN.

run as admin, kek

[DramaKing]

Not to beat a dead horse, but based on the available info, it may not be completely FUD. It could be detected at runtime without the execution method having anything to do with it. Or the registry key could push the heuristics just enough to trigger detection. Maybe try creating a scheduled task.