Private Crypter - Unique Private Stubs ◆ Spoof Call and Spoof SMS set any caller ◆ [#1] PURE RAT v4 // BEST HVNC RAT ◆ 🛒 View HF's Premium Marketplace ◆
Home Upgrade Search Memberlist Extras Hacker Tools Award Goals Help Wiki Contact
Hack Forums Hacks, Exploits, and Various Discussions Blackhat • Red Team • Offensive Security Remote Administration Tools › Is this a feasible way of never ever losing bots?

New Reply 

Is this a feasible way of never ever losing bots?
Zombie [ ✔ ]
Zombie [ ✔ ] Offline
[bin@HF:]
***
HF Ub3r
Posts:
692
Threads:
29
Credibility:
3800
Popularity:
589
βytes:
β 84
Game XP:
0
May 1, 2016 10:26 PM
RATS today in market allow us to edit the host files of windows. What if we inspect the network traffic with fiddler or wireshark during the update of antivirus and block all domains and hosts that send update to the antivirus by editing the host files.

This will prevent the AV from updating further and the stub will remain FUD forever for that particular machine.

Can someone help me compile a list of all update domains for most common AVs?

Am I thinking correctly? 🤨
Twixles
Twixles Offline
[bin@HF:]
***
HF Ub3r
Posts:
1,449
Threads:
8
Credibility:
000
Popularity:
115
βytes:
β 0
Game XP:
0
May 1, 2016 10:50 PM
Not that clever when it comes to exactly this, possibly ask someone like Armada. However I don't think this will work. I'd assume that the AV simply unblocks the domains again. However I have so many times been proven wrong when assuming that security isn't terrible. So I say give it a shot!
TheWarOwl
TheWarOwl Offline
[bin@HF:]
***
HF l33t
Posts:
896
Threads:
35
Credibility:
000
Popularity:
8
βytes:
β 0
Game XP:
0
May 1, 2016 11:31 PM
I'd agree, AV will probably find a way to still update.

However, you may be able to cook up something that stops it from doing that too.

There still are a few problems however, a sample still more than likely would get spread of your stub and AV would then be trip wired to do certain things when update servers cannot be contacted.

Your best bet is to carefully monitor a variety of AV and analyze its behavior. All this whilsts asking yourself "how does this system have loop holes?" Or "where can I look that the developer's have not?"

If the answer to those questions is as simple as referring to and protecting the Host file, best you keep it private :P
[Image: 5BgQiIm.gif]

Raymond Reddington
Raymond Reddington Offline
[ssh@HF:]
**********
Legends
Posts:
7,611
Threads:
213
Credibility:
274620
Popularity:
2,905
βytes:
β 24,676
Game XP:
790
May 1, 2016 11:46 PM
Well, looks like a neat idea, but I would assume AVs aren't so stupid that they won't update themselves just because host files block the domains. IDK, worth giving a shot. I have a few windows servers lying around, I will try this tonight.
Zombie [ ✔ ]
Zombie [ ✔ ] Offline
[bin@HF:]
***
HF Ub3r
Posts:
692
Threads:
29
Credibility:
3800
Popularity:
589
βytes:
β 84
Game XP:
0
May 2, 2016 12:16 AM (This post was last modified: May 2, 2016 12:19 AM by Zombie [ ✔ ].)
(May 1, 2016 10:50 PM)Twixles Wrote:  Not that clever when it comes to exactly this, possibly ask someone like Armada. However I don't think this will work. I'd assume that the AV simply unblocks the domains again. However I have so many times been proven wrong when assuming that security isn't terrible. So I say give it a shot!


Well, its not like AVs will self edit the host files and unblock the domains. The updates must come through some specific channel, what if we block that channel? Carefully analyze which hosts and ports are being used for the purpose and block them via host files or any other method.

I tried sniffing the packets through fiddler, it does not seem to work, would anyone be kind enough to help me with this?

(May 2, 2016 12:13 AM)Toxyiic Wrote:  With Luminosity 1.5 you can block programs internet access wouldn't that work too? I've tried it with Zemana Antimalware some weeks ago and i couldnt check for updates anymore.

Great, how does that work? I have LL, is there any guide for it?

Also, will the program's internet access remains cut off forever? Even after the system restarts? Does this work with all AVs?
Judicious⭐️
Judicious⭐️ Offline
01001010
***
HF l33t
Posts:
1,362
Threads:
15
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
May 2, 2016 12:24 AM
(May 1, 2016 10:26 PM)Zombie [ ✔ ] Wrote:  RATS today in market allow us to edit the host files of windows. What if we inspect the network traffic with fiddler or wireshark during the update of antivirus and block all domains and hosts that send update to the antivirus by editing the host files.

This will prevent the AV from updating further and the stub will remain FUD forever for that particular machine.

Can someone help me compile a list of all update domains for most common AVs?

Am I thinking correctly? 🤨

The way I used to do it is I coded my own personal persistence module and a task scheduled event program. Relatively small in size, that would check for my rat process. If not found it would connect to a public site and look for an updated and encrypted link. This would have various fall back sites to scrape from and several built in methods to attempt to remain undetected. Once it found the link for the updated rat file it would download and execute on system level. I've had success with this even after someone ran popular cleaning and antivirus utilities. The key is having multiple fallback methods.
[Image: lYc5kac.png]
Twixles
Twixles Offline
[bin@HF:]
***
HF Ub3r
Posts:
1,449
Threads:
8
Credibility:
000
Popularity:
115
βytes:
β 0
Game XP:
0
May 2, 2016 12:28 AM
(May 2, 2016 12:16 AM)Zombie [ ✔ ] Wrote:  Well, its not like AVs will self edit the host files and unblock the domains. The updates must come through some specific channel, what if we block that channel? Carefully analyze which hosts and ports are being used for the purpose and block them via host files or any other method.

I tried sniffing the packets through fiddler, it does not seem to work, would anyone be kind enough to help me with this?


Great, how does that work? I have LL, is there any guide for it?

Also, will the program's internet access remains cut off forever? Even after the system restarts? Does this work with all AVs?

Again I'm not that experienced or educated when it comes to networks, however from what I've read Armada seems pretty good at it. I say you PM him, or wait for him to reply here, he's pretty active.
VirtualMon3y
VirtualMon3y Away
[closed@HF:]
Posts:
1,641
Threads:
15
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
May 2, 2016 12:36 AM
Interesting ideas, I'll keep an eye on this thread. I like a good discussion.
Raymond Reddington
Raymond Reddington Offline
[ssh@HF:]
**********
Legends
Posts:
7,611
Threads:
213
Credibility:
274620
Popularity:
2,905
βytes:
β 24,676
Game XP:
790
May 2, 2016 12:37 AM
(May 2, 2016 12:24 AM)Judicious⭐️ Wrote:  The way I used to do it is I coded my own personal persistence module and a task scheduled event program. Relatively small in size, that would check for my rat process. If not found it would connect to a public site and look for an updated and encrypted link. This would have various fall back sites to scrape from and several built in methods to attempt to remain undetected. Once it found the link for the updated rat file it would download and execute on system level. I've had success with this even after someone ran popular cleaning and antivirus utilities. The key is having multiple fallback methods.

OP and you are on different tracks. You replace your detected file with new crypted version. OP's idea is never to get detected in the first place.
VirtualMon3y
VirtualMon3y Away
[closed@HF:]
Posts:
1,641
Threads:
15
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
May 2, 2016 01:05 AM
(May 2, 2016 12:37 AM)Raymond Reddington Wrote:  OP and you are on different tracks. You replace your detected file with new crypted version. OP's idea is never to get detected in the first place.

Still two interesting methods for keeping bots imo. Be cool to see this developed.
VirtualMon3y
VirtualMon3y Away
[closed@HF:]
Posts:
1,641
Threads:
15
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
May 2, 2016 01:09 AM (This post was last modified: May 2, 2016 01:10 AM by VirtualMon3y.)
(May 2, 2016 12:52 AM)Toxyiic Wrote:  Seems to work fine with mbam and zemana.
Downloading ESET rn gonna post update when im off my vpn again.
thats where you can block the Internet access of other Programs

Interesting, does it have a warning from the AV saying its unable to update at all other than on the AV control panel. Like a notification?

(May 2, 2016 01:07 AM)Toxyiic Wrote:  Sadly it seems that blocking eset isn't possible. Looks like blocking internet access only works at few antiviruses.

Must have multiple ways to connect/update?
VirtualMon3y
VirtualMon3y Away
[closed@HF:]
Posts:
1,641
Threads:
15
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
May 2, 2016 01:37 AM
(May 2, 2016 01:12 AM)Toxyiic Wrote:  No when updating it just says its not possible.
And when trying to block ESET it just doesnt work. They have some protection for that i guess.

or ESET have multiple ways to connect. This worth investigating more, you could still make a good tut on this.
VirtualMon3y
VirtualMon3y Away
[closed@HF:]
Posts:
1,641
Threads:
15
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
May 2, 2016 01:51 AM
(May 2, 2016 01:42 AM)Toxyiic Wrote:  The ip sometimes changed but i couldnt even block one.

And i probably gonna make a tutorial tomorrow. (Doing some tests b4)

Its still very useful, im pretty sure other antiviruses and definitely the free ones (wich most people use) can be blocked.
When i got time later i'll test AVG Avast Avira etc.

Nice, I'll look forward to your findings.
Lucifer Morningstar
Lucifer Morningstar Offline
hooman compiler
***
HF Ub3r
Posts:
1,800
Threads:
10
Credibility:
000
Popularity:
653
βytes:
β 0
Game XP:
0
May 2, 2016 04:24 AM
Quite a few still work. But you can give it a try and report back 🤝
Code
// Kaspersky
http://dnl-01.geo.kaspersky.com
http://dnl-02.geo.kaspersky.com
http://dnl-03.geo.kaspersky.com
http://dnl-04.geo.kaspersky.com
http://dnl-05.geo.kaspersky.com
http://dnl-06.geo.kaspersky.com
http://dnl-07.geo.kaspersky.com
http://dnl-08.geo.kaspersky.com
http://dnl-09.geo.kaspersky.com
http://dnl-10.geo.kaspersky.com
http://dnl-11.geo.kaspersky.com
http://dnl-12.geo.kaspersky.com
http://dnl-13.geo.kaspersky.com
http://dnl-14.geo.kaspersky.com
http://dnl-15.geo.kaspersky.com
http://dnl-16.geo.kaspersky.com
http://dnl-17.geo.kaspersky.com
http://dnl-18.geo.kaspersky.com
http://dnl-19.geo.kaspersky.com
http://dnl-00.geo.kaspersky.com

// ESET
um01.eset.com    91.228.166.13
um02.eset.com    91.228.166.14
um03.eset.com    91.228.166.15
um04.eset.com    91.228.166.16
um05.eset.com    91.228.167.132
um06.eset.com    91.228.167.133
um07.eset.com    38.90.226.36
um08.eset.com    38.90.226.37
um09.eset.com    38.90.226.38
um10.eset.com    38.90.226.39
um11.eset.com    91.228.166.88
um13.eset.com    38.90.226.40
um21.eset.com    91.228.167.26
um23.eset.com    91.228.167.21
um01.ru.eset.com    188.225.81.21
um01.cn.eset.com    182.254.173.27
um10.za.eset.com    41.71.77.123

// ESET LIVE GRID
h1-c01-b.eset.com    91.228.166.45
h1-c02-b.eset.com    91.228.166.46
h1-c03-s.eset.com    91.228.165.43
h1-c04-s.eset.com    91.228.165.44
h3-c01-s.eset.com    91.228.167.86
h3-c02-s.eset.com    91.228.167.87
h3-c03-s.eset.com    91.228.167.46
h3-c04-s.eset.com    91.228.167.103
h5-c01-b.eset.com    38.90.226.11
h5-c02-b.eset.com    38.90.226.12
h5-c03-b.eset.com    38.90.226.13
a.cwip.eset.com
ae.cwip.eset.com
c.cwip.eset.com
ce.cwip.eset.com
dnsj.e5.sk
dnsje.e5.sk
i1.cwip.eset.com
i1e.cwip.eset.com
i2.cwip.eset.com
i3.cwip.eset.com
i4.cwip.eset.com
i4e.cwip.eset.com
u.cwip.eset.com
ue.cwip.eset.com
incrementalupdate.eset.com

// ESET ANONYMOUS FILE SUBMISSION
tsm00.eset.com - tsm09.eset.com
tsm00.eset.com    91.228.167.134
tsm01.eset.com    91.228.167.135
tsm02.eset.com    91.228.166.143
tsm03.eset.com    91.228.166.144
tsm04.eset.com    91.228.165.59
tsm05.eset.com    91.228.165.60
tsm06.eset.com    91.228.165.61
tsm07.eset.com    91.228.166.11
tsm08.eset.com    91.228.167.93
tsm09.eset.com    91.228.166.11
ts.eset.com

// AVIRA
professional.avira-update.com
professional.avira-update.net
premium.avira-update.com
premium.avira-update.net

// AVG
update.avg.com
update.grisoft.com
backup.avg.cz
backup.grisoft.cz
files2.grisoft.cz
files2.avg.cz
download.grisoft.cz
download.avg.cz
akamai.grisoft.cz
akamai.grisoft.cz.edgesuite.net
akamai.avg.cz
akamai.avg.cz.edgesuite.net
akamai.grisoft.com
akamai.avg.com
akamai.grisoft.com.edgesuite.net
akamai.avg.com.edgesuite.net
[Image: MWjc9rm.png]
Raymond Reddington
Raymond Reddington Offline
[ssh@HF:]
**********
Legends
Posts:
7,611
Threads:
213
Credibility:
274620
Popularity:
2,905
βytes:
β 24,676
Game XP:
790
May 2, 2016 05:23 AM (This post was last modified: May 2, 2016 05:25 AM by Raymond Reddington.)
(May 2, 2016 01:05 AM)VirtualMon3y Wrote:  Still two interesting methods for keeping bots imo. Be cool to see this developed.

Am I not cool enough? 😎

(May 2, 2016 04:24 AM)Lucifer Morningstar Wrote:  Quite a few still work. But you can give it a try and report back 🤝
Code
// Kaspersky
http://dnl-01.geo.kaspersky.com
http://dnl-02.geo.kaspersky.com
http://dnl-03.geo.kaspersky.com
http://dnl-04.geo.kaspersky.com
http://dnl-05.geo.kaspersky.com
http://dnl-06.geo.kaspersky.com
http://dnl-07.geo.kaspersky.com
http://dnl-08.geo.kaspersky.com
http://dnl-09.geo.kaspersky.com
http://dnl-10.geo.kaspersky.com
http://dnl-11.geo.kaspersky.com
http://dnl-12.geo.kaspersky.com
http://dnl-13.geo.kaspersky.com
http://dnl-14.geo.kaspersky.com
http://dnl-15.geo.kaspersky.com
http://dnl-16.geo.kaspersky.com
http://dnl-17.geo.kaspersky.com
http://dnl-18.geo.kaspersky.com
http://dnl-19.geo.kaspersky.com
http://dnl-00.geo.kaspersky.com

// ESET
um01.eset.com    91.228.166.13
um02.eset.com    91.228.166.14
um03.eset.com    91.228.166.15
um04.eset.com    91.228.166.16
um05.eset.com    91.228.167.132
um06.eset.com    91.228.167.133
um07.eset.com    38.90.226.36
um08.eset.com    38.90.226.37
um09.eset.com    38.90.226.38
um10.eset.com    38.90.226.39
um11.eset.com    91.228.166.88
um13.eset.com    38.90.226.40
um21.eset.com    91.228.167.26
um23.eset.com    91.228.167.21
um01.ru.eset.com    188.225.81.21
um01.cn.eset.com    182.254.173.27
um10.za.eset.com    41.71.77.123

// ESET LIVE GRID
h1-c01-b.eset.com    91.228.166.45
h1-c02-b.eset.com    91.228.166.46
h1-c03-s.eset.com    91.228.165.43
h1-c04-s.eset.com    91.228.165.44
h3-c01-s.eset.com    91.228.167.86
h3-c02-s.eset.com    91.228.167.87
h3-c03-s.eset.com    91.228.167.46
h3-c04-s.eset.com    91.228.167.103
h5-c01-b.eset.com    38.90.226.11
h5-c02-b.eset.com    38.90.226.12
h5-c03-b.eset.com    38.90.226.13
a.cwip.eset.com
ae.cwip.eset.com
c.cwip.eset.com
ce.cwip.eset.com
dnsj.e5.sk
dnsje.e5.sk
i1.cwip.eset.com
i1e.cwip.eset.com
i2.cwip.eset.com
i3.cwip.eset.com
i4.cwip.eset.com
i4e.cwip.eset.com
u.cwip.eset.com
ue.cwip.eset.com
incrementalupdate.eset.com

// ESET ANONYMOUS FILE SUBMISSION
tsm00.eset.com - tsm09.eset.com
tsm00.eset.com    91.228.167.134
tsm01.eset.com    91.228.167.135
tsm02.eset.com    91.228.166.143
tsm03.eset.com    91.228.166.144
tsm04.eset.com    91.228.165.59
tsm05.eset.com    91.228.165.60
tsm06.eset.com    91.228.165.61
tsm07.eset.com    91.228.166.11
tsm08.eset.com    91.228.167.93
tsm09.eset.com    91.228.166.11
ts.eset.com

// AVIRA
professional.avira-update.com
professional.avira-update.net
premium.avira-update.com
premium.avira-update.net

// AVG
update.avg.com
update.grisoft.com
backup.avg.cz
backup.grisoft.cz
files2.grisoft.cz
files2.avg.cz
download.grisoft.cz
download.avg.cz
akamai.grisoft.cz
akamai.grisoft.cz.edgesuite.net
akamai.avg.cz
akamai.avg.cz.edgesuite.net
akamai.grisoft.com
akamai.avg.com
akamai.grisoft.com.edgesuite.net
akamai.avg.com.edgesuite.net


Dude seriously? Do you realise you solved 99 problems of holding bots if this method works.
Next Oldest | Next Newest
New Reply 


Possibly Related Threads...
Thread / Author Replies Views Last Post
by skynetT1000Jul 30, 2026 11:28 AM 4 138 Jul 30, 2026 11:28 AM
Last Post: Binance
by AtomicShadowMay 13, 2025 07:58 PM 3 316 May 13, 2025 07:58 PM
Last Post: AtomicShadow
by SwenchFeb 21, 2025 09:38 AM 10 326 Feb 21, 2025 09:38 AM
Last Post: DramaKing