[Hackers]

Hello all, I decided to try out an open source crypter called Lime Crypter, that was listed as having been revamped for 2024. I can report that as-is, it is not FUD or close to it in runtime.

In scantime, we see an average of 10+ out of 40 on KS tool, and on runtime we see 45+ on VT tool.
Unfortunately this is very bad as far as scores go for data privacy & runtime protection for software like this.

---

Here is the GUI that Lime uses when you run it:

---

Source Code Mirrors:

Code

https://github.com/LNodesL/Mordecai-Lime-Crypter-Forked
https://mega.nz/file/96UVnRAb#IOcFkm0JBXOGiyChWkauSiriseT80Z8oH4A6kKgBAWQ
https://www.mediafire.com/file/kofvmr2382rgxfz/Mordecai-Lime-Crypter-Forked-main.zip/file
https://github.com/Open-Mordecai/Mordecai-Crypter
https://github.com/NYAN-x-CAT/Lime-Crypter
https://mega.nz/file/wrdExAKA#Rp0tRN9MlW7OwwZNOH1gJHa8V0zpzOUtojaYNXg6I8w
https://www.mediafire.com/file/xh1ebeht7pfjysl/Mordecai-Crypter-main.zip/file
https://github.com/Open-Mordecai/Mordecai-Crypter/blob/main/FUD-Crypter-Undetected-2024-Windows.tar.gz

One huge benefit of the source, even if not FUD is that you can build your own tools from the GUI, and change the stub as needed...


An example of how to improve it could be to remove the Resource usage for a better method, like direct header include or raw binary data in the file.


Another way to improve the program would be to add compile-time encryption / runtime decryption, such as to protect the source better, like with the csharps runtime methods seen here:


A reference to 'Nyan' for the Nyancat runPE method is also very 'revealing' :


All in all, the improvements can be made I think to improve the scores seen below. If someone spends the effort, the stub and other files can be altered to significantly improve the program in my opinion.

---

Trial 1 - using RegASM
Spoiler (Click to View)
Scantime: 10+/40
https://www.kleenscan.com/scan_result/6c...8377a869db

Runtime: 45/70
https://www.virustotal.com/gui/file/b69d...?nocache=1

---

Trial 2 - Using RegSvcs
Spoiler (Click to View)
Scantime: 10+/40
https://www.kleenscan.com/scan_result/b5...15459d894c

Runtime: 45/70
https://www.virustotal.com/gui/file/fbe1...?nocache=1

---

Trial 3 - Bind to itself
Spoiler (Click to View)
Scantime: 10+/40
https://www.kleenscan.com/scan_result/3b...fb5fc5b28e

Runtime: 45/70
https://www.virustotal.com/gui/file/b624...?nocache=1

[PitbullT0r]

nodes please never leave this forum!
Always high-quality post!
Thanks.

[Hackers]

nodes please never leave this forum!
Always high-quality post!
Thanks.

Thanks!! that is much appreciated
I'll stay <3 and keep posting

[DynamicW]

That's very bad in my opinion. Lime crypter is basically a waste of time it's no use.

[Hackers]

That's very bad in my opinion. Lime crypter is basically a waste of time it's no use.

Agreed, I went into this thinking I would post the review no matter what, but did expect better.
The codebase isn't too shabby, I think it could be fixed. It looks like the guy who said it was revamped for 2024 didn't really make changes.

[Absence]

Agreed, I went into this thinking I would post the review no matter what, but did expect better.
The codebase isn't too shabby, I think it could be fixed. It looks like the guy who said it was revamped for 2024 didn't really make changes.

Yeah I think this will see very little use, however, I think you are doing a great job with analysis. Admittedly, I know little about coding crypters, but I am enjoying seeing the content you are providing. I am learning a bit on the way :)

Thanks!

[LLynn101]

Hey I am new on here , and seen your post about malware, would like to talk privately. Telegram X?? [deleted] is me. [warn]

[Hackers]

Hey I am new on here , and seen your post about malware, would like to talk privately. Telegram X?? [deleted] is me. [warn]

Hi, I do not offer ANY support for malware, blackhat methods, etc. I also do not take conversations off-site if I don't know someone, and you're not allowed to ask that here. I also don't use TG, and also I'm whitehat.