[pr0t0typ3]

Hey guys,
Basically I found a "exploit" which does allow something cool and I want your opinion:

1. You have a Scantime Cryter which does drop the crypted malware.
   


2. This Crypter does write one Registry Key before dropping the file.
   


3. The Scantime Crypter does drop the file and execute it.
   


4. No Anti-Virus Guard will pick it up until the victim does directly scan the file because of the Registry Key.
   

I tested it on Avira Anti-Vir and Kaspersky and I'm currently checking if it does work with the heuristic engines of the AVs, but yeah what do you think. Should I sell it ? It would make all RunPEs unnecessary.

[hxkd]

A trick like that would not last very long, and you just more or less told us how to do it (well, I guess we would need the location) but hell yeah, don't share stuff, sell it, too many leechers.

hxkd

[pr0t0typ3]

A trick like that would not last very long, and you just more or less told us how to do it (well, I guess we would need the location) but hell yeah, don't share stuff, sell it, too many leechers.

hxkd

The Registry is big and you would need the location to make it work but yeah I don't think I'll share it

[hxkd]

How on Earth did you find this though? :O

hxkd

The Registry is big and you would need the location to make it work but yeah I don't think I'll share it

[Xenon]

If you sell it, I will buy it in a heartbeat.

[New Age Griefing]

I definitely reccommend that u sell it

[DООM!]

Keep it for yourself and sell a crypter here, but keep sales limited.

[KillαMuvz]

Packers? :3 IF it is what I think you'll understand what I just said <3

[Supreme Kai]

Sell it you will get alot of customers.

[narutorine]

sell it but limited customers that's my opinion nice work :)

[wacked3]

Hey guys,
Basically I found a "exploit" which does allow something cool and I want your opinion:

1. You have a Scantime Cryter which does drop the crypted malware.
   


2. This Crypter does write one Registry Key before dropping the file.
   


3. The Scantime Crypter does drop the file and execute it.
   


4. No Anti-Virus Guard will pick it up until the slave does directly scan the file because of the Registry Key.
   

I tested it on Avira Anti-Vir and Kaspersky and I'm currently checking if it does work with the heuristic engines of the AVs, but yeah what do you think. Should I sell it ? It would make all RunPEs unnecessary.

This trick isn't new and will not work! Avirar for example checks all files and immadently ditches files that don't start with "MZ" (marking a Portable Executable)
Also it will make no effect to any AV with behaviour blocking (which could be considered a form of heuristics)
The registry key (HKEY_CLASSES_ROOT\) has been known for years.

[Mater™]

Loll ! i need a crypter for 64bit i give 50$ :O [email protected]

[Taserz]

once one av see a reg write it will then associate it as malware.

[pr0t0typ3]

once one av see a reg write it will then associate it as malware.

Uhm no ?! 90 % of all applications do write to the registry which does not mean they are maleware -.-