[onlinecrypt]

Hello HackForums users,

I am offering sales for an online crypting service at the following address: http://zti3trzlefnwcene.su

Details:
>>> Stub coded in C and x86/x64(wow64 syscalls) Assembly
>>> Supports PE32 and .NET PE32 (Must have valid .NET Metadata and must work with Assembly.Load loading, output remains a native file after encryption of a .NET Program.)
>>> Automatically appends overlay data
>>> Engine generates relatively unique crypts on each submit, it generates junk codes and mutate the NSIS Setup Installer script, it also encrypts the C/Assembly shellcode then appends a self decryptor which is slightly mutated when needed.
>>> Payload is ran using the RunPE method, all system API are called using manual system calls (int 0x2e, syscall/sysenter), it allows bypassing of behavioral filtering on 64bit operating systems because antiviruses are limited to user-mode API hooking, on 32bit operating systems few antiviruses still apply usermode hooking thus allows this crypter to bypass their whole filtering system.
>>> PE Loader execution is available to customers on demand, it's less compatible and will not process and callback Thread Local Storage (TLS) Directory.
>>> Code is tested and execution rate is maximum.
>>> Crypting website is automated, anonymous and keeps no tracking of the user information and files, cookies are used to store information about orders when processing payments, keep your browser open while making orders to avoid losing cookies and your order status.
>>> 7 days a week support & updates if required.

Price:
You can find every details about pricing on the site
Base price is $20 per crypt
Subscription is also available (Base: 1 day, 1 file for $20), check the site for more details.

Note: In case of scantime detected outputs, please contact support to get a token replacement.

Runtime testing:
Note: Eset's memory scanner is bypassed if the injected image remains in it's allocated region by the crypter, .NET executables does not remain in this region so eset's memory scanner is not bypassed with .NET programs.
Spoiler (Click to View)


Comodo has "virtualized" the application, but it does not detect it, also I doubt it can prevent manually performed system calls from executing on the host system.



Contact:
XMPP (Support/Sales): [email protected] (OTR Required)
Please do not PM support requests, I AM RESELLER ONLY.

[TheMockingBird]

Seems like a nice service, GLWS ! 👍

[onlinecrypt]

edit with new runtime scan done

[onlinecrypt]

service is clean

RESULTS: 0/35
AVG Free - OK
Avast - OK
AntiVir (Avira) - OK
BitDefender - OK
Clam - OK
COMODO - OK
Dr.Web - OK
eTrust-Vet - OK
F-PROT - OK
F-Secure - OK
G Data - OK
IKARUS - OK
Kaspersky - OK
McAfee - OK
MS Essentials - OK
ESET NOD32 - OK
Norman - OK
Norton - OK
Panda - OK
A-Squared - OK
Quick Heal - OK
Solo - OK
Sophos - OK
Trend Micro - OK
VBA32 - OK
Zoner AntiVirus - OK
Ad-Aware - OK
BullGuard - OK
FortiClient - OK
K7 Ultimate - OK
NANO - OK
Panda CommandLine - OK
SUPERAntiSpyware - OK
Twister - OK
VIPRE - OK

File Name TestScanPackage - Copy.exe
File Size: 414665
File MD5: f7878b1280bf94e7f95f8c056b9d336f
File SHA1: bc26734d4c2d619e7eadcd690ef8c1a7b4a20886
Check Time: 2017-01-18 14:00:38

Scan report generated by
Scan4You.Net

[French Products]

Look to be a legit and great service. GLWS.

[The Unknown Coder]

Using putty to prove your runtime means nothing. Every av knows putty is not harmful upon decryption. Any crypter shouldn't have a problem bypassing putty.


Use netwire. I'm interested in this service will buy once you prove a valid runtime.

[onlinecrypt]

Using putty to prove your runtime means nothing. Every av knows putty is not harmful upon decryption. Any crypter shouldn't have a problem bypassing putty.


Use netwire. I'm interested in this service will buy once you prove a valid runtime.

hello

your bot must be runtime fud, putty is runtime fud
if you don't want buy, then don't buy

thnx

[KingCoin]

No bot is fud runtime no decently used bot at least any used bot thats open to the public. You are basically saying you will not bypass anything because no bot is fud on runtime. I mean come on. And I do wish to buy I just said I did. Once you prove a valid runtime. I mean I saw your threads you offering free scans to dyncheck nothing is stopping from testing netwire.

Yeah I think the same...

[c-_-m]

how NOT to sell your product 101

[The Unknown Coder]

please

if you want to buy then buy, but pls dont play time waste

I do wish to buy! I been asking for like 5 posts to prove the runtime you are claiming. This is the only reason why I would buy and I am asking to you prove it and you keep refusing if you will not prove it, just say so and I will be on my way.

[KingCoin]

U got any client?


Please delete that...

[Uiqueblhats]

Runtime with putty WTF is this

[onlinecrypt]

Runtime with putty WTF is this

listen ,

purchase, make your tests, stop playing kiddie

if you are not satisfied, make a blacklist

and here your complains are justified

thnx

--

service updated

RESULTS: 0/35
AVG Free - OK
Avast - OK
AntiVir (Avira) - OK
BitDefender - OK
Clam - OK
COMODO - OK
Dr.Web - OK
eTrust-Vet - OK
F-PROT - OK
F-Secure - OK
G Data - OK
IKARUS - OK
Kaspersky - OK
McAfee - OK
MS Essentials - OK
ESET NOD32 - OK
Norman - OK
Norton - OK
Panda - OK
A-Squared - OK
Quick Heal - OK
Solo - OK
Sophos - OK
Trend Micro - OK
VBA32 - OK
Zoner AntiVirus - OK
Ad-Aware - OK
BullGuard - OK
FortiClient - OK
K7 Ultimate - OK
NANO - OK
Panda CommandLine - OK
SUPERAntiSpyware - OK
Twister - OK
VIPRE - OK

File Name TestScanPackage - Copy.exe
File Size: 382024
File MD5: afe9ffba8b20401659deb621f8825ac3
File SHA1: 71a53285409aac2cc9db170cffc9928c77bd886f
Check Time: 2017-01-19 21:44:04

Scan report generated by
Scan4You.Net

[©Ratatouille™]

I can vouch for the service ! Fucking fud runtime test by my self

[The Unknown Coder]

I can vouch for the service ! Fucking fud runtime test by my self

What did you test with? Hopefully not putty like OP. If you tested with something real let op know so he can update his scan into something valid.