[img]http://bit.ly [WARNING: potentially infected]/ivKhuv[/img]
IF YOU ARE READING THIS PLEASE READ MY SIGNATURE!
Hello fellow HF members, I'm here to present with a brand new, noob-friendly weekly guide. I'm here demonstrating the knowledge that The RAT's Crew has, and for next weeks I will be covering multiple subjects on R.A.Ting and all that it involves. I with the help of several other members will provide extensively detailed information on every subject.
WEEK #1 - See it HERE!
- For the second week I'm going to cover the intermedian of R.A.Ting which is:
- Security/Protection
- File undetection / encryption, what it is, what it does.
- Settings using .net crypters, vb6 and c++.
- Sources download link.
- Settings using .net crypters, vb6 and c++.
- Methods: FileSplit+HEX Editing
- Introduction to Spreading.
- Tips 'n Tricks.
Security / Protection
Well after reading my first edition you might be thinking it is all safe. How can anyone catch me?
There are some easy ways to do it, seriously.
Such as:
- Reverse engeneering (No one would waste time doing that.)
- Simply click Start > Run > CMD > Type netstat -a > Look out for any strange IP you do not recognize > Trace it.
- Using tools such as WireShark.
So what can I do to prevent me from getting caught?
Lets think a bit, if you stablish a connection it will appear on the netstat right?
Well what if you DON'T stablish one? Get it?
So with this we have 2 different methods, and an extra one which is sort of useless.
- Using PHP R.A.T.'s. Why? Well read the previous week edition and you'll see that PHP R.A.T.'s do not connect directly, therefore your IP will not be visible to netstat or any other method.
- This is now a bit more "advanced" > Blackshades R.A.T [One of the best R.A.T.s out there] has a really unique feature : Asynchronous Mode! What is that all about? Well on asynchronous mode You (your client) will only re-connect every 5 mins , or any other time interval, to check if they are still online, or when you decide to send them any command. Efficient right?
- VPN (Virtual Private Network). You can think of a VPN as tunnel (VPN tunneling), if I were to explain it all it would take ages. So short and to the point. It work like a proxy, but for every single connection you do. Let's say your IP is 1XX.XXX.X.XXX , while using a VPN your IP will automaticaly change to the VPN's. Therefore if they try to hunt you down they'll fail miserably as they will only be able to trace the VPN. This will work for every connection you make. Yet, there has to be a bad side. Most of the VPNs for sale keep loggs and do not have open ports, thus making them pretty much useless because you'll need your ports forwarded. They are not for free. Anyway, if you're trying to buy a VPN look out for the loggs part and the ports. Some exemple "RATing compatible" VPNs : Blackshades VPN.
Ok, so now you've got an idea on how to not get caught.
Moving on.
File undetection / encryption
You've got everything set up right? and you want to start infecting people. You've tried to send it to a friend and his Anti-Virus poped up and deleted the file?
Well Anti-Virus companies are smarter then you thing. They update everyday with new virus / malware signatures. Meaning your virus some day, some how WILL be detected.
But how can I at least make if Fully Un-Detecteable for a period of time?
That's why there are these freaky tools that do things begginners could not have imagined. Those tools are called Crypters or Obfuscators.
So what they will do is cover up your Virus to make it FUD!
How does it work?
It's a bit complex so I'll cut it short.
A Crypter can be:
- Scantime : When the A-V runs a scan on your PC it will not be found, this is if your piece of malware if STILL FUD. Or when you simply check online if it is FUD using some online scanners such as My-AvScan.com or Scan4You.
- Runtime : This is the most common, and loads of free crypters only are Runtime FUD. Meaning they are undetecteable while running the PC normaly without making the A-V go berserke, BUT once the user decides to do a system scan the server WILL be detected, even if it still is FUD runtime. Crypter will need a RunPE to make it Runtime, as the runPE injects the server into a process.
- Or both. If you're planning on buying a Crypter make sure it if Scan and Run time FUD .
Crypters work with this little .exe called STUB. The stub is the most essential part. What the crypter does is to "join" the stub with your piece of malware. The stub will "cover up" the malware making it non-readable while encrypted, thus making it invisible to the A-V engines. After the Crypted file is run the stub will drop the file in a directory and decrypt it with the encryption password and run it.
Here's some images to clear things out:
[img]http://dl.dropbox.com/u/19745684/22.jpg[/img]
[img]http://dl.dropbox.com/u/19745684/images.jpg[/img]
Downloaded a Crypter but there is only ONE .exe?
It is because these tools can have:
- External Stubs : You'll find an .exe or a .dll file on the crypters folder.
- In-built Stubs : These have the stubs "inside" the crypter, therefore no need to have more then one .exe file.
Just to add to your vocabulary. There's a BIG difference between FUD and UD. UD, Un-Detectable means ONE OR MORE AntiVirus acuses your file as an infection. FUD is ONLY when NO AntiVirus acuses an infection.
Crypters also can be DEPENDENT or NON-DEPENDENT.
~The most common dependencie is .Net Framework. Using a crypter written in VB.Net or C# will make your server dependent, meaning the victim you try to infect will have to have installed in his machine a version of DotNet Framework. That can be considered a bad thing, yet any version of windows latter then Windows XP sp2 will have it installed, so considering the odds of having a dead computer that doesn't even has SP2 it will work pretty good.
Java Crypters are also dependent, the victim will have to have Java installed on his machine.
Any other language like :
- C++ / ASM
- Delphi
- VB6
Are NON-Dependent, meaning it can be ran in ANY Windows OS machine.
Now to broad your knowledge a bit more: USG. Unique Stub Generator is a "stub maker" as you might have got by the name. It creates a whole new unique stub from the one you used before, making stubs less equal, meaning that IF a stub you generated gets detected using another stub created by USG the chances are that one will be FUD.
This also can be:
- In-built. (Most Crypters)
- External (i.e. Fly Crypter )
Here are some crypter's sources for you to study if you want to learn a bit more about how they work!
[img]http://bit.ly [WARNING: potentially infected]/j5Emfc[/img]
Spoiler (Click to View)
For now we are done with the crypters.
Anyway...
There are tons of other ways to FUD your malware.
One of them is Hex Editing. In this edition I'll cover the simple method of Hex editing (the easier and less time consuming) which is basicly: File Spliting + Basic Hex editing.
Why is Hex editing necessay here?
Well as you might have read before in this thread some signatures are tagged by some AntiVirus, thus changing them with Hex editing will make those detections go away.
(Don't go all ninja and change everything. If you do that you'll surely corrupt the .exe)
We will not cover full HEX editing. Why? There are thousands of tutorials for it. Simply use the search button.
Spreading
At this point you have to know what spreading is. If not, spreading is "sharing" your malware with multiple people, over the internet, with the intention to get them running your server. There are multiple methods. In this edition we will just show the types of spreading.
There are TWO types of spreding:
- Targeted : This means to a specific group, type of people, or to a single person.
- Un-targeted : This is also the "RANDOM" spreading. You do not direct it towards any group. You simple want people to run it. For this you can use Youtube Videos, Torrent, Post in Forums, and many other thing.
On the next edition we will teach you some effective methods.
- TIPS:
- NEVER, but NEVER, scan your files in VirusTotal.com . They will distribute your sample to AV companies making your stub detected faster. You can use online scanner such as novirusthanks.org (ticking "do not distribute sample"), my-avscan.com, OnlineCrypter.com, Scan33.com, and some others.
- For the spreading part, here are some things that will help:
- Untargeted
- Bind it] with a fake program. A keygen is the best way. Pretend it is a keygen for a very good program. For me Adobe collections CS5 worked pretty good. Windows come with a binder, iexpress.exe . There are plenty of tutorials on how to use it.
- Use your imagination, innovate.
- Bind it] with a fake program. A keygen is the best way. Pretend it is a keygen for a very good program. For me Adobe collections CS5 worked pretty good. Windows come with a binder, iexpress.exe . There are plenty of tutorials on how to use it.
- Targeted
- This is the only type of spreading I do. Why? More profit for me. I usually target my teacher and it works. How? Well simply say you are having dificulties resolving a worksheet you found on the internet (And never say it is you, always give someone else's name.).
HERE's me inside my teachers PC. BUT if you're doing this, PLEASE, be carefull and take every security measures possible.
- This is the only type of spreading I do. Why? More profit for me. I usually target my teacher and it works. How? Well simply say you are having dificulties resolving a worksheet you found on the internet (And never say it is you, always give someone else's name.).
- Untargeted
- Knowing that you can be see through CMD.exe running the Netstat -a command can also help you seeing if you're infected.
Use the command netstat -b , it will show you what file / .exe is using what connection, works as some sort of firewall with no option to block. :3
- ALWAYS name your server some trusted windows file to "bypass" the curious eye. The most used filenames are:
- svchost.exe
- explorer.exe
- iexplorer.
- taskmgr.exe [this one is my favourite]
- svchost.exe
- NEVER, but NEVER, scan your files in VirusTotal.com . They will distribute your sample to AV companies making your stub detected faster. You can use online scanner such as novirusthanks.org (ticking "do not distribute sample"), my-avscan.com, OnlineCrypter.com, Scan33.com, and some others.
- TRICKS:
- You can change any .exe's extension to:
- .com [Name your file something like "pic102 @ youremail@something" . Get it? :3]
- .pif
- .scr [Screen savers, this one also works fine for spreading]
- .bat
- .com [Name your file something like "pic102 @ youremail@something" . Get it? :3]
- You can also "spoof" you're extension using a very well known public method. (You first will need to set the files to show extensions by going to Control Panel > Folder Options , look around and find something like : Show files extensions.)
Go to Start > RUN > Charmap > Now look for the character that will correspond to " U+202E : Left-To-Right overdrive" > Select it and copy > Go to your server , Right Click > Rename > Let's say your file is "image.exe". First add a space like this "image .exe". > Now paste the U+202E you just copied to right after the "e"> write the extension you want, BACKWARDS, like:- 3pm FOR mp3
- gpj FOR jpg
- xcod FOR docx
- fdp FOR pdf
- iva FOR avi
And so on and so on. You can choose ANY extension.
[FOR WINDOWS XP USER: Follow THIS tutorial here in order to install Unicode Characters so you can use this method!]
- 3pm FOR mp3
- Some detection can be bypassed easily by just adding an HighRes Icon [Avira, sometimes] or a TRUSTED assembly like the HiJackThis program. To change an assembly or icon you can use : ResourceHacker.
- You can change any .exe's extension to:
Thus ends our first week edition of: The RAT's Crew - Tips 'n Tricks.
CREDITS
- KillαMuvz: Design, Tip 'n Tricks, Crypters/undetection explanation, Security, Spreading.
- Tibit: File Spliting TuT.
Untill next week,
KillαMuvz
![[Image: FZfdLoX.gif]](https://i.imgur.com/FZfdLoX.gif)
![[Image: v4EP4in.png]](https://i.imgur.com/v4EP4in.png)
