[Burnzy]

[img]http://img16.imageshack.us/img16/3444/inactivitybanner.png[/img]

this info is from RAT's crew tips and tricks week #2 which can be found here i just extracted it so you guys can bookmark this thread and learn much more about crypters credits for the tut goes to RC leader killamuvz and others who helped <3

also check out The RAT's Crew tips n' tricks week #3

Check out!!!
Cryptex crypter!!

File undetection / encryption

You've got everything set up right? and you want to start infecting people. You've tried to send it to a friend and his Anti-Virus poped up and deleted the file?

Well Anti-Virus companies are smarter then you thing. They update everyday with new virus / malware signatures. Meaning your virus some day, some how WILL be detected.

But how can I at least make if Fully Un-Detecteable for a period of time?

That's why there are these freaky tools that do things begginners could not have imagined. Those tools are called Crypters or Obfuscators.
So what they will do is cover up your Virus to make it FUD!
How does it work?
It's a bit complex so I'll cut it short.
A Crypter can be:

• Scantime : When the A-V runs a scan on your PC it will not be found, this is if your piece of malware if STILL FUD.
  


• Runtime : This is the most common, and loads of free crypters only are Runtime FUD. Meaning they are undetecteable while running the PC normaly without making the A-V go berserke, BUT once the user decides to do a system scan the server WILL be detected, even if it still is FUD runtime. If a crypter says RunPE somewhere it means it is Runtime
  


• Or both. If you're planning on buying a Crypter make sure it if Scan and Run time FUD.
  

Crypters work with this little .exe called STUB. The stub is the most essential part. What the crypter does is to "join" the stub with your piece of malware. The stub will "cover up" the malware making it non-readable while encrypted, thus making it invisible to the A-V engines. After the Crypted file is run the stub will drop the file in a directory and decrypt it with the encryption password and run it.

Here's some images to clear things out:


Downloaded a Crypter but there is only ONE .exe?
It is because these tools can have:

• External Stubs : You'll find an .exe or a .dll file on the crypters folder.
  


• In-built Stubs : These have the stubs "inside" the crypter, therefore no need to have more then one .exe file.
  

Just to add to your vocabulary. There's a BIG difference between FUD and UD. UD, Un-Detectable means ONE OR MORE AntiVirus acuses your file as an infection. FUD is ONLY when NO AntiVirus acuses an infection.

Crypters also can be DEPENDENT or NON-DEPENDENT.
~The most common dependencie is .Net Framework. Using a crypter written in VB.Net or C# will make your server dependent, meaning the slave you try to infect will have to have installed in his machine a version of DotNet Framework. That can be considered a bad thing, yet any version of windows latter then Windows XP sp2 will have it installed, so considering the odds of having a dead computer that doesn't even has SP2 it will work pretty good.
Java Crypters are also dependent, the slave will have to have Java installed on his machine.
Any other language like :

• C++ / ASM
  


• Delphi
  


• VB6

Are NON-Dependent, meaning it can be ran in ANY Windows OS machine.

Now to broad your knowledge a bit more: USG. Unique Stub Generator is a "stub maker" as you might have got by the name. It creates a whole new unique stub from the one you used before, making stubs less equal, meaning that IF a stub you generated gets detected using another stub created by USG the chances are that one will be FUD.
This also can be:

• In-built. (Most Crypters)
  


• External (i.e. Fly Crypter )
  

Here are some crypter's sources for you to study if you want to learn a bit more about how they work!
[img]http://bit.ly [WARNING: potentially infected]/j5Emfc[/img]
Spoiler (Click to View)
Click HERE for my thread FULL OF SOURCES!
(Had to use a separate thread. Words limit reached.)

For now we are done with the crypters.

Anyway...

There are tons of other ways to FUD your malware.
One of them is Hex Editing. In this edition I'll cover the simple method of Hex editing (the easier and less time consuming) which is basicly: File Spliting + Basic Hex editing.

Why is Hex editing necessay here?
Well as you might have read before in this thread some signatures are tagged by some AntiVirus, thus changing them with Hex editing will make those detections go away.
(Don't go all ninja and change everything. If you do that you'll surely corrupt the .exe)

File Split + Hex Editing
Spoiler (Click to View)

1. You'll need an Hex Editor. You can use /koKazL]THIS free one.
   


2. Pick the server you want to edit (Recomended Uncrypted, but otherwise is good too.)
   


3. Turn off your A-V (Results may vary, it all depends on your AntiVirus, so pick a good one).
   


4. Now place you server in new folder. Rename it to test.exe. If you scan it now you'll see it is detected!
   


5. Open the File Splitter and Calc.exe [Start>RUN>Calc.exe].
   Open the server you want to split in the FileSplitter and choose Custom Size. You can see my server's size is 53,495 bytes and I want to split it into 4 pieces. Go to Calc and divide 53,495 (Use your malware's size) by 4. Type the result in the Custom Size box, like in this image. Click on Split.
   [img]http://bit.ly [WARNING: potentially infected]/mQpBl0[/img]
   


6. Your folder should look like this with the splitted files.
   [img]http://bit.ly [WARNING: potentially infected]/k0DnMI[/img]
   


7. Scan the files, the ones which get detected will have to be split again. After finding out the one who causes the detection create a new folder named the number of the that was detected. My detected part is #3.
   


8. Browse to test.exe.3 (your file that caused detection), split it again using the same method (Calc.exe and divide the size by 4, again). Change the output folder to the one you just made on the step before. Mine will be 3.
   [img]http://ploader.net/files/96d248fe3dbff6967200d966b6427cb9.png[/img]
   


9. The new folder should look like my folder 3 looks like.
   [img]http://ploader.net/files/7c6d020fc5c1003ef17d09b2947985d7.png[/img]
   


10. Re-Scan. Find the part causing the detection. My detected part is test.exe.3.3. So I'll make a subfolder, name 3.
    


11. Browse to the file, on File Splitter, that got detected. Mine was test.exe.3.3. For the output directory choose the subfolder you just made, mine will be 3.
    [img]http://ploader.net/files/d10ef6d6a8d1c032d150a9da725439a6.png[/img]
    


12. Scan all files again. Find the one causing the detection. Mine was test.exe.3.3.4, so follow I'll make a new folder named 4.
    


13. Browse the detected file in File Splitter. Mine, test.exe.3.3.4, and for the output folder choose the one you just made, mine is 4.
    [img]http://bit.ly [WARNING: potentially infected]/jBJsF9[/img]
    


14. Re-Scan, find the one that acused detection and open it in the HEX Editor. If it is too big continue splitting and finding the detection. If not, proceed.
    Ok. My detected file is test.exe.3.3.4.1 . So I'll open it now. It will look something like this.
    [img]http://bit.ly [WARNING: potentially infected]/l4gnva[/img]
    


15. Now the Virus Signature is in here. All you really have to do is change a letter from capital to a lower case one. I changed "D" to a lower case "d" from the word DLLHOOKSTRUCT.
    [img]http://bit.ly [WARNING: potentially infected]/k77AJ9[/img]
    


16. Save it. Scan it. CAREFULL, Do not do it too randomly, it CAN corrupt your malware.
    


17. Now re-compiling. I'll show one step, the rest is just the same.
    See the file splitter icon there? Click it and it will recompile.
    [img]http://bit.ly [WARNING: potentially infected]/itp37L[/img]
    


18. Copy that file and paste it in the previous folder. Replace it. Do the same you did previously. And continue copying pasting, recompiling untill you get to the first folder.
    


19. Done!

[Ton33y]

Awesome guide man! Explained everything I needed to know about crypters!

[Get Hit]

i love the tut mate nice good

[devilpsn]

Nice Guide I saw some of the same information in the crypter's blue print by xiniflitrate

[Burnzy]

you gotta love this one, hope the next week will be soon, i think we're out of ideas.

[Glype]

Nice tut mate. very well explained

[Unkraft]

Nice tut man, still need a lot of time to master this fud rat **

[rip2444]

Nice tutorial.... i was wondering what the heck Stub.exe was...

[Burnzy]

yeah, you see that word alot, good to know what does it means.

[Nathan Moriarty]

Just to add to your vocabulary. There's a BIG difference between FUD and UD. UD, Un-Detectable means ONE OR MORE AntiVirus acuses your file as an infection. FUD is ONLY when NO AntiVirus acuses an infection.

I don't see the difference between 'fully undetected' and 'undetected'. Can someone explain?

[BloodFire]

I don't see the difference between 'fully undetected' and 'detected'. Can someone explain?

~_~ fully undetected is when you crypt a virus and it is fully undetected by any type of anti-virus/spyware like when you scan and the result is 0/33 that is called FUD.

un-detected is when you crypt a virus and some anti-virus/spyware detect them and some don't. Example when you scan and the result is 3/33 that means it is just UD not FUD.

[Nathan Moriarty]

~_~ fully undetected is when you crypt a virus and it is fully undetected by any type of anti-virus/spyware like when you scan and the result is 0/33 that is called FUD.

un-detected is when you crypt a virus and some anti-virus/spyware detect them and some don't. Example when you scan and the result is 3/33 that means it is just UD not FUD.

I don't see how that is possible. Let's say my grandma was completely (fully) dead. Then non of her inner organs would be functional (ex. 0/33), and again, if she was dead it would be same outcome; 0 operative organs.
SHORT: Dead = Fully dead, either your dead or your not. Not just a little dead.

[bobby2]

Nice TuT, Very well explained about File Split + Hex Editing to FUD the Server

[Burnzy]

I don't see how that is possible. Let's say my grandma was completely (fully) dead. Then non of her inner organs would be functional (ex. 0/33), and again, if she was dead it would be same outcome; 0 operative organs.
SHORT: Dead = Fully dead, either your dead or your not. Not just a little dead.

triple 🤣 do you even know what av is how many of them exists and how do they work?know what av is how many of them exists and how do they work?

[Nathan Moriarty]

triple 🤣 do you even know what av is how many of them exists and how do they work?know what av is how many of them exists and how do they work?

I didn't completely understand what you are trying to say. Correct me if I'm wrong; You're asking if I know what an antivirus is, how many antivirus programs exists, and how they work? Which isn't relevant to my original assertion. Quote fail?

I can try to rewrite my statement in a more understandable way; 'Fully undetected' = 'undetected'. It's like an ON/OFF switch, its either undetected or detected.