[Feminist]

Developed in C++ and FASM
No dependencies
Resource cloner
FUD, runtime, scantime, bypass all av's including kaspersky, avast, and pretty much all other runtimes. (Unless the crypted file calls an API hooked with a ring0kit such as SetWindowsHookEx for keyboard hooks - nothing can bypass such paranoia)

It uses a unique method to protect the file, so no RunPE/WriteProcessMemory/etc API calls.

I will implement "add to startup" and "install" features. There is currently no support for EOF data. (This can be easily added)

How much would you pay for this per month?

[N3oNight]

it dosent matter if uses runpe or not,
the thing matter is for how many days or how long will it be FUD.

[OnlyBOTNET]

it dosent matter if uses runpe or not,
the thing matter is for how many days or how long will it be FUD.

And if it has dependencies.

#Thread

For FASM i would pay 50$/week for C++ 20$/week max.

[Ρain]

What difference would it not being RunPE make? I honestly don't know.

[Feminist]

Well.. every memory scan would detect it so.. its same of a runpe except that doesn't uses detected APIs by HIPS and Firewall.

Almost every single HIPS and Firewall detect RunPE nowadays. It's a dead horse, when there are so many better alternatives to use.

It is FUD for weeks at a time, and it has no dependencies outside of the windows operating system itself. It only needs kernel32.dll to run (and well, of course ntdll.dll) as well as any dll's that the crypted process needs (such as ws32_dll.dll, etc)

[Razοr]

Almost every single HIPS and Firewall detect RunPE nowadays. It's a dead horse, when there are so many better alternatives to use.

It is FUD for weeks at a time, and it has no dependencies outside of the windows operating system itself. It only needs kernel32.dll to run (and well, of course ntdll.dll) as well as any dll's that the crypted process needs (such as ws32_dll.dll, etc)

hips still have huge problems detecting dynamic forking and i don't see how a firewall should...

Also for the FUD-time, how can you tell? I tested a lot of techniques to increase it and only testing them on long-term was able to tell if they are effective.

[Feminist]

hips still have huge problems detecting dynamic forking and i don't see how a firewall should...

Also for the FUD-time, how can you tell? I tested a lot of techniques to increase it and only testing them on long-term was able to tell if they are effective.

All an antivirus needs to do is hook a few functions (such as CreateProcess, NtUnmapViewOfSection) and they will instantly know that you are using RunPE thus detect your payload.

Not every antivirus does this- but a lot do. Your RunPE crypter might be scantime FUD, but it won't work in runtime against many antiviruses these days.

Maybe in 2008/2009/2010 you could get away with RunPE; but these days its just something you can't get away with anymore.

In my opinion, there's no point calling a crypter FUD if it can't get past the AV's it should during runtime.

hips still have huge problems detecting dynamic forking and i don't see how a firewall should...

Also for the FUD-time, how can you tell? I tested a lot of techniques to increase it and only testing them on long-term was able to tell if they are effective.

You can increase FUD time by giving users unique executables. Of course, there is always some "part" of your code they begin to detect- so even FUD time has its limits per reprogram.

[AnonymousDDOxz]

All an antivirus needs to do is hook a few functions (such as CreateProcess, NtUnmapViewOfSection) and they will instantly know that you are using RunPE thus detect your payload.

Not every antivirus does this- but a lot do. Your RunPE crypter might be scantime FUD, but it won't work in runtime against many antiviruses these days.

Maybe in 2008/2009/2010 you could get away with RunPE; but these days its just something you can't get away with anymore.

In my opinion, there's no point calling a crypter FUD if it can't get past the AV's it should during runtime.

You can increase FUD time by giving users unique executables. Of course, there is always some "part" of your code they begin to detect- so even FUD time has its limits per reprogram.

Give us some more information about that unique method that you didn't invent.

[Feminist]

Give us some more information about that unique method that you didn't invent.

It's not publicly released. I never claimed to have invented it. It maps the executable into memory, fixes imports, relocs and passes control to it. It's also got a few layers of protection.

[Bo Burnham.]

I wouldn't care. As long as its FUD and as long as it works with a lot of software.

[betamonkey]

People just want something that is undetected by both signature scans and behavior monitoring. The 'method' used is mostly irrelevant. On a side note:

but it won't work in runtime against many antiviruses these days.

Isn't true. All 'RunPE' is, is code injection to create a zombie process and there are plenty of ways to get around HIPS for that.

[Feminist]

People just want something that is undetected by both signature scans and behavior monitoring. The 'method' used is mostly irrelevant. On a side note:

Isn't true. All 'RunPE' is, is code injection to create a zombie process and there are plenty of ways to get around HIPS for that.

I'm sure that there are ways to get around HIPS for creating a zombie process. However, I'm sure most crypters on Hackforums are using the "standard" and "cookie-cutter" version of RunPE.

Additionally, some Antiviruses hook NtUnmapViewOfSection, WriteProcessMemory and will detect any file as malware if they call those functions.

Anyway. Nobody has really answered how much they would pay for this crypter per month.

[betamonkey]

I'm sure that there are ways to get around HIPS for creating a zombie process. However, I'm sure most crypters on Hackforums are using the "standard" and "cookie-cutter" version of RunPE.

Additionally, some Antiviruses hook NtUnmapViewOfSection, WriteProcessMemory and will detect any file as malware if they call those functions.

Anyway. Nobody has really answered how much they would pay for this crypter per month.

Just make it private and sell spots for something like $200 per x week(s). Take on a few customers and you'll have way less stress with that rather than dealing with many dozens of whining kids expecting to pay $20-something a month

[Xenon]

If you want to make a crypter that will sell welll, give it a feature that the other popular crypters don't already have. Not a feature that's pointless, but something unique and useful. Get creative. Creativity is a key component to a successful product.

[IRP_MJ_SCSI]

Additionally, some Antiviruses hook NtUnmapViewOfSection, WriteProcessMemory and will detect any file as malware if they call those functions.

That's absolute bullshit, tonnes of legitimate processes use both functions and aren't detected.