[hackedia]

Hello as title says i want to know what thing i should modify on the crypter source code so AV's can't detect actually i got a few crypter source code from github and from some private paid/free leaks(most of them are written in C# and vb) and i have a little bit of C# knowledge literally you can assume i'm a noob in programmings 😝
In the crypters programs all the settings looks similar to other crypters like algorithms etc but I can't figure what actually AV's look on? Mechanism? Strings? Anything? Can some programmers or pro users give some idea to me? 🤐
Thanks 🤝

[gigajew]

It really depends on which part of the code is marked as detected. Usually AV's just get an overall signature for the specific crypter, so your best bet would be to rewrite your logic from scratch. You should make it harder to get a generic signature from it by implementing some sort of USG ('Unique Stub Generator') functionality, that should keep it FUD longer.

[hackedia]

It really depends on which part of the code is marked as detected. Usually AV's just get an overall signature for the specific crypter, so your best bet would be to rewrite your logic from scratch. You should make it harder to get a generic signature from it by implementing some sort of USG ('Unique Stub Generator') functionality, that should keep it FUD longer.

So where should i start looking? in source code? in PE? in Hex?

[gigajew]

So where should i start looking? in source code? in PE? in Hex?

Study what a crypter needs to be a crypter from your source, code it yourself so that it’s similar but not identical

[hackedia]

Study what a crypter needs to be a crypter from your source, code it yourself so that it’s similar but not identical

Alright got it thanks 🤝

[CyberStrike]

Well AV's look for a few things say that a .text or .rodata is a certain hash size, or maybe there is something in the .strings .. I did a small bit of research on bypassing AV's from using tools to breaking down the file with no crypter being used. It is very time consuming

The best result came from the manual method detailed here:

https://hackforums.net/showthread.php?ti...id56594593

When that file was first scanned it was 15/64 I am guessing it has been rescanned a few times since and it at 34 detections. The manual method is much more labor/time intensive but you really get great results.

Edit: This is far from what all av's look for but also some use various detection methods like yara you will see this mainly on endpoints but still you want to really learn and when you do AV evasion manually please disconnect from the internet on that VM.