Home Upgrade Search Memberlist Extras Hacker Tools Award Goals Help Wiki Contact

[FREE] Crypting Service for Native files.

Introduction
As hackdforums learnt me alot, helped me alot, now I will try to help some members with the knowledge I earned.

What's it ?

This is a handmade crypting service for NATIVE FILES meaning it does not support .NET files.  I don't use any crypter, meaning I have direct access to source code, making it easy to refud. I will be free as long as I desire it.

What will happen to my file ?

Your exe native file will be firstly turned into bytes array, after what those bytes will be encrypted with a simple but powerful encryption algorithm making them unpossible to be flagged by AVs in scantime. Then those bytes will be embbeded in the stub that will write, decrypt and finally execute your exe in memory using runPE method.

Is this service FUD ?

This service is not FUD since I conserve methods to bypass all AVs for personal uses. However I will make all my possible to maintain the detection rate under 2/35. Actually it is 1/35 for the public stub.

How to proceed to profit of this service ?

To avoid of being spammed by a wave of kids, I add an anti-skids method. Here is a code that, after decrypted, will give you a key. Then, on the top of the PM you will send me, just include this key, otherwise I will ignore your message. Upload your server wherever in rar or zip with "789" as password and disable anti-Vm.
Here is the code you have to decrypt ( easy )
Code
103 157 156 147 162 141 164 165 154 141 164 151 157 156 163 040 164 150 145 040 153 145 171 040 151 163 040 042 111 040 167 151 154 154 040 163 143 141 156 040 155 171 040 163 164 165 142 040 157 156 154 171 040 157 156 040 116 157 144 151 163 164 162 151 142 165 164 145 040 141 156 144 040 126 151 162 165 163 103 150 145 143 153 115 141 164 145 042


I will start to crypt servers when I have time for.
Hope you will like this service, give feedbacks and improvments on the thread would be appreciated. ( Excuses for english mistakes I could have done )
Have fun
Easy_hax.
I think u dubble posted fam, happens to me aswell
Will it bypass RUNTIME WindowDefender, AVAST, AVG?

Your PMs are full...
Nice post. But i don't understand correctly. LUL haha
(Sep 27, 2017 08:32 AM)AceVoid Wrote:  Will it bypass RUNTIME WindowDefender, AVAST, AVG?

Your PMs are full...

Cleaned PMs, I tested against Windows Defender and it bypassed it like charm, will try very soon on Avast.
Can bypass smartscreen ?
TY
(Sep 27, 2017 12:44 PM)Nekfeu Wrote:  Can bypass smartscreen ?
TY

I'm on Win7 so don't have smartscreen, but send me your skype in PM we could test it together.
(Sep 27, 2017 12:44 PM)Nekfeu Wrote:  Can bypass smartscreen ?
TY

just remove the stub ZoneID than rar it up to prevent it from being readded
Cool but how do you want to bypass runtime protection? Even if you have AES encryption or whatsoever as soon as the file is executed it will be detected. Just saying
(Sep 28, 2017 07:07 AM)LastSession Wrote:  Cool but how do you want to bypass runtime protection? Even if you have AES encryption or whatsoever as soon as the file is executed it will be detected. Just saying

It's injected into memory with runPE method, meaning nothing is written on hard disk.
(Sep 28, 2017 09:03 AM)EASY_HAX Wrote:  It's injected into memory with runPE method, meaning nothing is written on hard disk.

Thanks for clarifying that. You should still get 2/32 or so without anti-emulation but for a free one it's good enough
(Sep 28, 2017 09:06 AM)LastSession Wrote:  Thanks for clarifying that. You should still get 2/32 or so without anti-emulation but for a free one it's good enough

Yeah it's 2/35 Avira and Eset flag it, but i'm currently working on api hooking to get better results.
(Sep 28, 2017 10:04 AM)EASY_HAX Wrote:  Yeah it's 2/35 Avira and Eset flag it, but i'm currently working on api hooking to get better results.

Im pretty sure avira is a string/custom name based detection, also is it a public RunPE?, modified?
(Sep 28, 2017 12:40 PM)kevy42 Wrote:  Im pretty sure avira is a string/custom name based detection, also is it a public RunPE?, modified?

Already changed strings a couple of times and avira still flag it, I guess it's due to AV's emulation.
Yeah it is a modfied runPE class.
(Sep 28, 2017 12:49 PM)EASY_HAX Wrote:  Already changed strings a couple of times and avira still flag it, I guess it's due to AV's emulation.
Yeah it is a modfied runPE class.

Almost all avira detections iv had were dropper.tr and gen, most removed by changing strings, i rarely do get avira to drop me an Fbomb and detrct an actual peace of code, last time it was The memory check call. I dont get string based detections anymore, my usg scrables all custom names in the stub


Possibly Related Threads...
Thread / Author Replies Views Last Post
by meodollar123May 21, 2026 09:26 AM 0 212 May 21, 2026 09:26 AM
Last Post: meodollar123
by ImComplexedMar 11, 2025 06:40 PM 7 317 Mar 11, 2025 06:40 PM
Last Post: nath95
by loomixxFeb 11, 2025 02:38 AM 1 148 Feb 11, 2025 02:38 AM
Last Post: loomixx