Real exe spoofing

Jan 6, 2012 09:40 PM

This is just simple code that i knocked together, that can be taken further.
Now we all know that you can spoof a exe ext to look like a jpg etc.
But it a bigger give away when you run the spoofed jpg, as nothing happens.
This demo is different.
When you run the spoofed file it displays the jpg and runs your code (in the background) and deletes its self and replays its self with a real jpg.
Now this will work just as well with mp3 etc as really play them.
In the zip you will find two files one spoofT.exe and one spoof.exe
If you want you can just run spooft.exe and see the demo
Or you can run spoof.exe to make a .jpg ver of spooft.exe

Any way when you run it, it will open you default image app show the jpg and in the background delete it self and place a real jpg in it place.
Thats all it does, but it could also run any code.
You can get it here:
http://www.dex-os.com/Truth/Spoof.zip

AV test here:
Spoiler (Click to View)
It will be fud if its of value and i can post the simple code.

Jan 6, 2012 11:24 PM

Hmmm. Still not real, It just changes it to a .scr

Jan 7, 2012 10:50 AM

(Jan 6, 2012 11:24 PM)Extensive Wrote: Hmmm. Still not real, It just changes it to a .scr

This is why most of you get know where, if you are on XP the ext spoof does not work.
But the point of this demo is not the .xxx change, its the fact that it runs the same as a jpg, but also run as a exe in the background.

This may help to show what it does
The fake jpg:
[img]http://www.dex-os.com/Truth/Shot1.jpg[/img]

When you click the fake jpg:
[img]http://www.dex-os.com/Truth/shot2.jpg[/img]

When you closes the default image app
[img]http://www.dex-os.com/Truth/Shot3.jpg[/img]

The fake is self deleting and it is replaced with a real jpg.
It could also install your keylogger or RAT before deleting its self etc.
This would also play mp3, mpeg4, or open txt files, pdf etc.

0xebfe · Jan 7, 2012 12:08 PM

Detected by kaspersky, but would work on some dumb blonde with file extensions turned off I suppose.

Jan 7, 2012 12:17 PM

There was no effort made to make it FUD, that would be easy to do, but theres little point, if it does not have the main pay load.
For example spoof.exe is not fud, but it just rename the file using unicode right to left.
Most ASM code stuff is not fud, as most virus are ASM.

Darkrazor89 · Jan 7, 2012 08:27 PM

the 'jpeg of death'.. brings back memories :P

Jan 7, 2012 10:58 PM

(Jan 7, 2012 12:08 PM)0xebfe Wrote: Detected by kaspersky, but would work on some dumb blonde with file extensions turned off I suppose.

God good thing im asain:P + humm maybe ill try this out later...

Jan 8, 2012 06:44 AM

(Jan 6, 2012 09:40 PM)DexHacker Wrote: This is just simple code that i knocked together, that can be taken further.
Now we all know that you can spoof a exe ext to look like a jpg etc.
But it a bigger give away when you run the spoofed jpg, as nothing happens.
This demo is different.
When you run the spoofed file it displays the jpg and runs your code (in the background) and deletes its self and replays its self with a real jpg.
Now this will work just as well with mp3 etc as really play them.
In the zip you will find two files one spoofT.exe and one spoof.exe
If you want you can just run spooft.exe and see the demo
Or you can run spoof.exe to make a .jpg ver of spooft.exe

Any way when you run it, it will open you default image app show the jpg and in the background delete it self and place a real jpg in it place.
Thats all it does, but it could also run any code.
You can get it here:
http://www.dex-os.com/Truth/Spoof.zip

AV test here:
Spoiler (Click to View)
It will be fud if its of value and i can post the simple code.

I'd love a FUD version of this, it seems very interesting. I'm only starting out with this hacking stuff and this would help me out a lot. Hit me back if you're going to continue developing this.

Jan 8, 2012 11:58 AM

I actually wrote a tutorial on this but I cba to find it. A good way of spoofing people into thinking its a JPG:

1) Make your exe open the file once it's run (Most crypters can do this)
2) Change the icon to the same as a JPG
3) Rename it 'tits.jpg - [email protected]'

The .com works the same as a .exe.

Jan 8, 2012 02:03 PM

I have uploaded a fud ver (as far as novirusthanks)
http://www.dex-os.com/Truth/FudSpoof.zip
Spoiler (Click to View)
The way that, this is different from other out there is that its self deletes, but also replace its self with real jpg, so once run, even if they take a close look at the jpg its real.

This is coded in ASM, but could be done in other languages, so if any VB code want to code a ver, let me know and i will help or i can post the code, if enough want it.

Jan 10, 2012 06:37 PM

**!!! You are very strong thank you very much "DexHacker" !!!**

Jan 11, 2012 01:37 AM

how i wish there were ext spoofing for macs the same way as well as rats

Jan 11, 2012 11:34 AM

I have note tried, but the idea should work for mac too.

Jan 28, 2012 08:55 AM

i have the download and everything, but im slightly confused on what file its spoofs to a jpg or jpeg, how exactly do i spoof a file? ( like the steps) sorry, im new to all this

Jan 28, 2012 03:20 PM

Unzip the file from this post https://hackforums.net/showthread.php?ti...id18892530

In the zip you will find two files one called spoof.exe and one called spoofT.exe.

The spoofT.exe is the program its self that does not have its ext spoofed, So if you run it, it will display the jpg and put a real jpeg where you open the file and than delete its self.

If you run spoof.exe it will pop a message box saying 'press OS to spoof exe to jpeg'
When you press ok a second file will be put on the place you opened the file caled 'testrcs.jpg'
If you run this file it will do the same as spoofT.exe but is should have a .jpg ext.

Now in the next day or two i will release the finished ver that lets you spoof your own file and as it fud it will make any file you bind with it fud.

Login
Username/Email:
Password:	Lost Password?
	Remember me