[Rs6]

Hello to all 🙂
Can anyone recommend a crypter that is xworm 6.0 compatible and has no problem with plugins?
I mean no errors of this type when you try to open a plugin on the client:

Plugin error!Could not load file or assembly '1633280 bytes loaded from XWormClient,Version=1.0.0.0,Culture=neutral,PublicKeyToken=null' or one of its dependencies. An attempt was made to load a program with an incorrect format.

Thanks in advance.

[R5N3T]

Hopefully someone here can help you out with this, bro.

[ServersFxcked]

Wouldn't use anything passed 5.6 as its not the real xCoder

[CL1B]

Wouldn't use anything passed 5.6 as its not the real xCoder

^

[jmark7]

thats is runtime detection from windows defender when the plugin is loaded.
No Crypter can bypass it, Only way to bypass is to re-fud the plugins.

You can PM me with your TG ID if you need professional solution on it.

[Pankii]

You have been caught by Amsi. You have to obfuscate your xworm DLL's or add amsi bypass in your client code. The second option might be worse than first but it makes permanent solution.

[gvnscrutinizer]

AMSI are scanning the plugin bytes.

---

thats is runtime detection from windows defender when the plugin is loaded.
No Crypter can bypass it, Only way to bypass is to re-fud the plugins.

You can PM me with your TG ID if you need professional solution on it.

Not true- you just need an amsi bypass that propagates for all sequential plugin loads by the rat payload

---

Hopefully someone here can help you out with this, bro.

its due to using a mid tier crypter which doesnt consider runtime activity from the payload itself i.e. loading plugins. the payload itself may have not triggered amsi but xworm loads plugins via assembly.load(byte) which get scanned by amsi.

[CL1B]

What's up with everyone thinking this has anything to do with AMSI?

The bytes have been loaded already, you guys clearly do not know how AMSI works.

This is caused by arch mismatching and nothing else, if you have the source code; Compile the stub and plugins in the same x64 arch.

In some cases (especially when dealing with old projects) there will a missing dependency, you can easily find, download and add this using dependency walker or fus log viewer.

For those who don't know how AMSI works; Go to mimikatz PS github and use the script command, watch how loud AMSI screams it's name.

Much different.

[Frost Crypt]

What's up with everyone thinking this has anything to do with AMSI?

The bytes have been loaded already, you guys clearly do not know how AMSI works.

This is caused by arch mismatching and nothing else, if you have the source code; Compile the stub and plugins in the same x64 arch.

In some cases (especially when dealing with old projects) there will a missing dependency, you can easily find, download and add this using dependency walker or fus log viewer.

For those who don't know how AMSI works; Go to mimikatz PS github and use the script command, watch how loud AMSI screams it's name.

Much different.

because it does most likely, I'm getting a very similar detection when my .net file is loaded into memory in powershell via [System.Reflection.Assembly]::Load($...);
When that happens I have to refud it to fix it.

Exception calling "Load" with "1" argument(s): "Could not load file or assembly '50688 bytes loaded from Anonymously
Hosted DynamicMethods Assembly, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null' or one of its dependencies. An
attempt was made to load a program with an incorrect format."

This is what I'm getting and WD blocks it SILENTLY, you need to keep wd opened to see the detection, there is no notification.

So if xworm is storing these plugins as bytes, wd tagged them and gives that silent detection when you're trying to load them.

So try to lose some of your big balls attitude because you don't know half as much as you think you know and bullying others while being wrong is pretty embarrassing.

Op can use any crypter he wants, until those plugins are refuded, they will fail to load.

[CL1B]

OP, You're better off with a stack overflow search.

Trust.

[gvnscrutinizer]

What's up with everyone thinking this has anything to do with AMSI?

The bytes have been loaded already, you guys clearly do not know how AMSI works.

This is caused by arch mismatching and nothing else, if you have the source code; Compile the stub and plugins in the same x64 arch.

In some cases (especially when dealing with old projects) there will a missing dependency, you can easily find, download and add this using dependency walker or fus log viewer.

For those who don't know how AMSI works; Go to mimikatz PS github and use the script command, watch how loud AMSI screams it's name.

Much different.

Youre so confidently wrong lmao. xworm and many other modular rats load plugins reflectively via assembly.load(byte[]). xworm is heavilty signatured so the bytes get scanned by amsi and blocked

[possessed-client]

Hello to all 🙂
Can anyone recommend a crypter that is xworm 6.0 compatible and has no problem with plugins?
I mean no errors of this type when you try to open a plugin on the client:

Plugin error!Could not load file or assembly '1633280 bytes loaded from XWormClient,Version=1.0.0.0,Culture=neutral,PublicKeyToken=null' or one of its dependencies. An attempt was made to load a program with an incorrect format.

Thanks in advance.

Well, flame wars notwithstanding, it's easy to figure out whether the problem is with AV detecting plugins or something else by testing in a VM with and without AV protection. And if it is AV, then yeah, you either have to FUD the plugins by modifying source and recompiling or trying various obfuscators. Alternatively, you have to bypass AMSI for the process trying to load the plugin, and if the plugin is detected even on disk before execution, then you have to rewrite how the RAT handles plugins, so it bypasses AMSI, then decrypts the plugin and only then loads and runs it.

Here's a recent topic with a similar problem: https://hackforums.net/showthread.php?tid=6317704

Your idea of using a crypter might work if it has a working AMSI bypass and the plugin isn't detected on disk (or maybe even in memory) before AMSI gets into play with Assembly.Load call to the plugin path or variable in memory.

[Rs6]

Thanks to all for answers.
So if i understand correctly, i need to find or crypter that bypasses amsi or way to obfuscate plugins?

[gvnscrutinizer]

Thanks to all for answers.
So if i understand correctly, i need to find or crypter that bypasses amsi or way to obfuscate plugins?

yup. send me a pm if you want help with confirming its amsi blocking plugin loads and what would needa be done.

[Frost Crypt]

Thanks to all for answers.
So if i understand correctly, i need to find or crypter that bypasses amsi or way to obfuscate plugins?

you need to crypt better maintained products or find someone to refud those plugins otherwise you will just waste money on crypters