Feb 19, 2011 06:30 PM
(This post was last modified: Feb 3, 2013 12:49 PM by Omniscient.)
Hello everyone,
And welcome to my thread related to topic on how to lower the detection rate and make an effective crypter in Visual Basic (Remember, this is only for .NET, but some of the techniques I used can be also used in other languages as well). So you came to this thread wondering how to FUD or at least UD your crypter against the Anti-Virus scanners, well you came to the right place! This tutorial does not contain and particular/private technique that could be tagged by an Anti-Virus or anything, so mixing it with your imagination you could easily make an effective and UD crypter. So let's begin, shall we ?
STEP 1: (Encrypting Strings)
So let's say that we got our plain non-obfuscated code and it is detected, so let's say that our code looks like this:
Content deleted to prevent possible harm to our members. -Staff
As you can see, it's just a plain code, which Anti-Virus vendors could easily tag. So what we're going to do first is encrypt all possible strings. In case you don't know what is a string, a string is, essentially, a sequence of characters, and it looks like this: "Hello, I'm string! Understand?"
Note: Do not encrypt APIs just yet, because if you do you will most likely corrupt the API declaration, which would cause a more trouble, so don't do it just yet.
So to encrypt our strings, we need a encryption algorithm, which is in this case already there (XOR encryption). But in case your encryption's output is not compatible with the Editor's syntax, you can easily just encode the text with any encoding algorithm, I recommend a built-in encoding algorithm, which is Base64 which can be easily accessed within 1 line of a code.
So, this is how it should look after we encrypt our strings:
Content deleted to prevent possible harm to our members. -Staff
You may not notice a big differences, that's just because this source code has only few string declarations, but in real stub code it would've more encryptable values, of course this is just an example but you should get the point. So that's how you encrypt your strings, it is really important yet simple step which will past most of the AntiViruses, but this was just beginning don't get too excited just yet.
STEP 2: (Obfuscating Variables)
So in next part of the tutorial, I will be showing you how to obfuscate variables. You may think that this involve a usage of 3rd party application , but you're wrong. This can be done manually too , and it is much more effective than using any 3rd party application since they may corrupt your assembly or add random detections, so it's always better to do it manually since you know what you're dealing with rather than guessing what's that obfuscator doing to your code.
So, obfuscating variables is relatively easy and can be done in 2 simple steps:
And that's it. And it should look like something like this:
Content deleted to prevent possible harm to our members. -Staff
Note: You choose from 3 different character-set types of for your variables's names:
STEP 3: (Encrypting APIs)
For this part of tutorial, I am going to use snippet from AeonHack, but with few modifications. To get a source code of a snippet that allows you to dynamically call APIs just click on the link bellow:
His thread:
https://hackforums.net/showthread.php?tid=652914
OR
http://pastebin.com/LbEDMqjX
So once you get it, just copy/paste the code to your class/module and make delegates of your APIs, basically taking the signatures of real APIs but just without declaring a library or anything related to API which can be detected by Anti-Virus:
Real API:
Delegated API:
Note: You can use whatever name you want for it, but make sure you remember the real Function Name & Library, in this case it was SizeOfResource as function name and kernel32 as library name (kernel32:SizeOfResource).
Once you do everything as I said, this is how it should look:
Content deleted to prevent possible harm to our members. -Staff
Now you can easily encrypt/encode and obfuscate the APIs declarations and calls by using this cool function. Which will past 90% of the detections, in case you have any other detections related to the API it is probably the usage of the APIs so I recommend you to either find different way of using the API or write own function that does whatever you're doing for you, like me in some cases. You can always find a backup APIs, since some APIs have similar or even same features, for example LoadLibrary and GetModuleHandle, they even have same usage and signature / parameters, and they do the same thing, which is retrieving the Memory Address of the libraries.
Anyway, let's back to our topic. Next thing that you can do is encrypt and obfuscate your APIs, and it should look like something like this:
Content deleted to prevent possible harm to our members. -Staff
STEP 4: (Optimizing & Reducing the size)
This is not really required, but it is recommended to modify & optimize your code a bit. For instance, you can edit and randomize the parameters (signatures) of your functions and subs. This won't really affect anything nor it will bypass any detections (or it may will), but it will for sure confuse the Malicious Software Analysts, of course this can be implemented (for instance) in your U.S.G (Unique Stub Generator) so each time you generate new stub code it will scramble and randomize the functions parameters.
Content deleted to prevent possible harm to our members. -Staff
Note: You can only change signatures of the your custom made functions, DO NOT change any API parameters otherwise it will corrupt that API declaration.
Also, you can reduce the size of your stub by removing or replacing some code with new one, for instance you can reduce the string's length by renaming it to the one with lower length of characters.
Next this that you can do is to remove unused references and also playing with "Compile" settings.
Remove Unused References:
Content deleted to prevent possible harm to our members. -Staff
The End
Well that's it for today folks, I hope you enjoyed my tutorial and if you did, please rate it with 5*. Also if you have any question related to this subject feel free to PM me or comment on this thread. Good luck! ✌
Credits: AeonHack
And welcome to my thread related to topic on how to lower the detection rate and make an effective crypter in Visual Basic (Remember, this is only for .NET, but some of the techniques I used can be also used in other languages as well). So you came to this thread wondering how to FUD or at least UD your crypter against the Anti-Virus scanners, well you came to the right place! This tutorial does not contain and particular/private technique that could be tagged by an Anti-Virus or anything, so mixing it with your imagination you could easily make an effective and UD crypter. So let's begin, shall we ?
STEP 1: (Encrypting Strings)
So let's say that we got our plain non-obfuscated code and it is detected, so let's say that our code looks like this:
Content deleted to prevent possible harm to our members. -Staff
As you can see, it's just a plain code, which Anti-Virus vendors could easily tag. So what we're going to do first is encrypt all possible strings. In case you don't know what is a string, a string is, essentially, a sequence of characters, and it looks like this: "Hello, I'm string! Understand?"
Note: Do not encrypt APIs just yet, because if you do you will most likely corrupt the API declaration, which would cause a more trouble, so don't do it just yet.
So to encrypt our strings, we need a encryption algorithm, which is in this case already there (XOR encryption). But in case your encryption's output is not compatible with the Editor's syntax, you can easily just encode the text with any encoding algorithm, I recommend a built-in encoding algorithm, which is Base64 which can be easily accessed within 1 line of a code.
So, this is how it should look after we encrypt our strings:
Content deleted to prevent possible harm to our members. -Staff
You may not notice a big differences, that's just because this source code has only few string declarations, but in real stub code it would've more encryptable values, of course this is just an example but you should get the point. So that's how you encrypt your strings, it is really important yet simple step which will past most of the AntiViruses, but this was just beginning don't get too excited just yet.
STEP 2: (Obfuscating Variables)
So in next part of the tutorial, I will be showing you how to obfuscate variables. You may think that this involve a usage of 3rd party application , but you're wrong. This can be done manually too , and it is much more effective than using any 3rd party application since they may corrupt your assembly or add random detections, so it's always better to do it manually since you know what you're dealing with rather than guessing what's that obfuscator doing to your code.
So, obfuscating variables is relatively easy and can be done in 2 simple steps:
- Select and hit your Ctrl + H
- Then just simply write a new name for that variable and replace it with new one
And that's it. And it should look like something like this:
Content deleted to prevent possible harm to our members. -Staff
Note: You choose from 3 different character-set types of for your variables's names:
- ASCII - http://www.robelle.com/smugbook/ascii.html
- Unicode - http://en.wikipedia.org/wiki/List_of_Unicode_characters
- Numbers - (0123456789)
STEP 3: (Encrypting APIs)
For this part of tutorial, I am going to use snippet from AeonHack, but with few modifications. To get a source code of a snippet that allows you to dynamically call APIs just click on the link bellow:
His thread:
https://hackforums.net/showthread.php?tid=652914
OR
http://pastebin.com/LbEDMqjX
So once you get it, just copy/paste the code to your class/module and make delegates of your APIs, basically taking the signatures of real APIs but just without declaring a library or anything related to API which can be detected by Anti-Virus:
Real API:
Code
Private Declare Function SizeofResource Lib "kernel32" (ByVal hModule As IntPtr, ByVal hResInfo As IntPtr) As IntegerDelegated API:
Code
Delegate Function SizeOfResource(ByVal hModule As IntPtr, ByVal hResInfo As IntPtr) As IntegerNote: You can use whatever name you want for it, but make sure you remember the real Function Name & Library, in this case it was SizeOfResource as function name and kernel32 as library name (kernel32:SizeOfResource).
Once you do everything as I said, this is how it should look:
Content deleted to prevent possible harm to our members. -Staff
Now you can easily encrypt/encode and obfuscate the APIs declarations and calls by using this cool function. Which will past 90% of the detections, in case you have any other detections related to the API it is probably the usage of the APIs so I recommend you to either find different way of using the API or write own function that does whatever you're doing for you, like me in some cases. You can always find a backup APIs, since some APIs have similar or even same features, for example LoadLibrary and GetModuleHandle, they even have same usage and signature / parameters, and they do the same thing, which is retrieving the Memory Address of the libraries.
Anyway, let's back to our topic. Next thing that you can do is encrypt and obfuscate your APIs, and it should look like something like this:
Content deleted to prevent possible harm to our members. -Staff
STEP 4: (Optimizing & Reducing the size)
This is not really required, but it is recommended to modify & optimize your code a bit. For instance, you can edit and randomize the parameters (signatures) of your functions and subs. This won't really affect anything nor it will bypass any detections (or it may will), but it will for sure confuse the Malicious Software Analysts, of course this can be implemented (for instance) in your U.S.G (Unique Stub Generator) so each time you generate new stub code it will scramble and randomize the functions parameters.
Content deleted to prevent possible harm to our members. -Staff
Note: You can only change signatures of the your custom made functions, DO NOT change any API parameters otherwise it will corrupt that API declaration.
Also, you can reduce the size of your stub by removing or replacing some code with new one, for instance you can reduce the string's length by renaming it to the one with lower length of characters.
Next this that you can do is to remove unused references and also playing with "Compile" settings.
Remove Unused References:
- Double click My Project, placed at the right size of Visual Basic by default.
- Click on References tab
- Click on Unused References to export list and then to remove click on Remove button
Content deleted to prevent possible harm to our members. -Staff
The End
Well that's it for today folks, I hope you enjoyed my tutorial and if you did, please rate it with 5*. Also if you have any question related to this subject feel free to PM me or comment on this thread. Good luck! ✌
Credits: AeonHack
