[t0fx]

Here's a C# crypter basis.
- it uses read / write resources to bypass Avira
- the crypted exe is stored as .bin compressed file into the resources
- execution from memory (runPE)

[img]http://img10.hostingpics.net/pics/631479Sans_titre.jpg[/img]

You can freely use and mod it, just add credits to t0fx, julian and Deathader (for the vb.net read / write resources I converted to c#).
I want to add credits to the runPE class but I don't know who coded it.

2 links :
if you support my work, u can use this one from sharecash :

Code

http://share cash.org/download.php?file=884764

else :

Code

http://www.multiupload.com/ZF1LX6T4TL

[cysto]

Thanks t0fx. Always contributing for the good of the community.
PS: First to reply! :P

[Pyro™]

Thanks t0fx. I'll look through it in a second

[PAGMAN]

What are the RunPE specs? Win 7 & vista? 64 bit?

thanks

[t0fx]

What are the RunPE specs? Win 7 & vista? 64 bit?

thanks

I don't know I only tested on my xp 32 bit so I let you test.
If you have a better runPE you can replace the one I use because I think it's crappy lol.

[PAGMAN]

I don't know I only tested on my xp 32 bit so I let you test.
If you have a better runPE you can replace the one I use because I think it's crappy lol.

Ok. Thanks man. BTW, where did you get the RunPE from?

---

BTW, I'm going to try to convert this to vb.net later. So if anyone wants it, PM me or somethin..

[t0fx]

Ok. Thanks man. BTW, where did you get the RunPE from?

---

BTW, I'm going to try to convert this to vb.net later. So if anyone wants it, PM me or somethin..

Posted by check24 on malwares-in.net, but I don't know if he coded it or found it somewhere.

[cysto]

@PAGMAN: Save your work; I already did it :P :
http://pastebin.com/dakJXK0s
(Removed all the spaces and comments)
And just a heads-up: It doesn't work on Vista or 7: Detected by DEP.

[Da Loser]

Aaah Nice Share =P t0fx

is this the one that you are selling :O

[t0fx]

Aaah Nice Share =P t0fx

is this the one that you are selling :O

I only sell a vb.net crypter source now, I made this one public because the runpe is not really good.

[¶_¶]

That's amazing! Thanks t0fx.

[Bitwin]

I only sell a vb.net crypter source now, I made this one public because the runpe is not really good.

Does that one have 64bit runPE ?

[Da Loser]

I only sell a vb.net crypter source now, I made this one public because the runpe is not really good.

aah ok. well very nice share.

it is a step forward :D

maybe i can add somekind of backup dropper for this to work on 64 bit D:

---

Does that one have 64bit runPE ?

yes it does.

great indeed =D

[StaTiX]

Nice share t0fx
i was amased by your moon crypter and now you are releasing C# crypter
AMAZING.

[PAGMAN]

@PAGMAN: Save your work; I already did it :P :
http://pastebin.com/dakJXK0s
(Removed all the spaces and comments)
And just a heads-up: It doesn't work on Vista or 7: Detected by DEP.

Thanks cysto. Saved me a bunch of work.