[mixer]

i have some questions about Crypters:

1. where are the best places/sections of the stub to keep a payload?
2. what are the most effective injection techniques?

[globalroot]

1. A server.
2. Read this by mistermistake which I totally agree:
"Process hollowing is one of shittiest evasion techniques imo. Removing sections, adding new sections, setting thread context are very obvious operations. Especially when the thread is suspended, itz not hard to see that the process is hollowed out. svchost.exe is a very suspicious and widely used process. Can even compare it with copy on disk."

[mixer]

1. A server.
2. Read this by mistermistake which I totally agree:
"Process hollowing is one of shittiest evasion techniques imo. Removing sections, adding new sections, setting thread context are very obvious operations. Especially when the thread is suspended, itz not hard to see that the process is hollowed out. svchost.exe is a very suspicious and widely used process. Can even compare it with copy on disk."

don't all these crypters (even the ones being sold on this forum) use these injection techniques?

[globalroot]

don't all these crypters (even the ones being sold on this forum) use these injection techniques?

Even if they do, they shouldn't.

[mixer]

Even if they do, they shouldn't.

then what are the better ways to do it?

[globalroot]

then what are the better ways to do it?

Other evasion techniques, like dll unhooking.

[Tentco]

i have some questions about Crypters:

1. where are the best places/sections of the stub to keep a payload?
2. what are the most effective injection techniques?

1. Keep it as shellcode and xor it and saved it as chunks along the section, some loader does it.

2. There are many injection techniques most crypter uses same old techniques but with advancement for eg LoadPE with their own windows loader or shc injector with indirect/veh calls etc...

[happygonutty]

i have some questions about Crypters:

1. where are the best places/sections of the stub to keep a payload?
2. what are the most effective injection techniques?

1. The best way you can do is improvise techniques that aren't well known, you can check out lots of sources by reading malware write-ups and checking their mistakes why they got detected.

2. There are some and globalroot has already indicated a good one which is DLL unhooking which is not very obvious and doesn't get easily detected as long as you have a "personal" or "private" technique on how to unload it. And of course, since this is something out of the ordinary question, 100% that nobody would answer this question since these types of questions are normally answered in exchange for money. Most answers you will get are from people who just searched google and advise you with existing methods that can already be detected.

don't all these crypters (even the ones being sold on this forum) use these injection techniques?

True, but there are some here who make improvisations so it cannot be detected easily but most of the time it would get detected but the crypter author would definitely patch the crypter and notify their users via thread or pm I think.

Other evasion techniques, like dll unhooking.

I vouch this and this is one of the unusual methods that up to this date, doesn't get detected easily especially if the writer has a way of unhooking DLLs in an unusual way and not yet known.