No matter what RAT I use, or what crypter, or what settings, I get the same amount of detections (16-18), all with the same detection spammed across the results. Gen:Variant.Razy.*insert a random number*.
I have learned through the Crypter Bible that this is simply a matter of assembly information and icon? If this is the case, then what magic assembly or fucking icon must I use to get past these detections? No matter what I use, it is still detected across the board. What happened to RATs being easy :/? It used to be all you needed was fucking DarkComet and a random crypter and you were good to go.
Don't these AV companies have better things to do than going after RATs, like finding real scammers and real viruses, like ransomware and things that destroy infrastructure? 🤦♂
Sorry to break it to you but there's this thing called the runtime and if you thought bypassing scantime detections with assembly info & icon changes was complex you're in for a real treat.
As soon as that stuff is popped on a system with any decent AV it's going to be shot down pretty quick. Good AV's are active at ring 0 while your stuff is in ring 3 or 2 at best. It's also incredibly hard to maintain persistence since AVs are now turning to using ELAM.
No detections across "all" (or realistically most) top AVs is why those sort of builds can cost a real pretty penny.
Aug 11, 2018 01:41 AM
(This post was last modified: Aug 11, 2018 01:42 AM by DafforDucc.)
(Aug 11, 2018 01:16 AM)Cød3ing Wrote: Sorry to break it to you but there's this thing called the runtime and if you thought bypassing scantime detections with assembly info & icon changes was complex you're in for a real treat.
As soon as that stuff is popped on a system with any decent AV it's going to be shot down pretty quick. Good AV's are active at ring 0 while your stuff is in ring 3 or 2 at best. It's also incredibly hard to maintain persistence since AVs are now turning to using ELAM.
No detections across "all" (or realistically most) top AVs is why those sort of builds can cost a real pretty penny.
lol you sound like a cuck for the AV companies, or an undercover AV employee on HF. Well, I did something pretty simple and figured out how to get rid of those generic detections, and the RAT is 100% functional. Got it down to 8 detections out of 30, compared to the 16-18 before due to generic shit. Some of the legit detections that is from the code itself is still there, but they are more obscure/expensive AV's picking up on it. Shit like AVG, Avast and Windows Defender aren't picking up on them, so gg mate.
(Aug 11, 2018 01:42 AM)FuxXER Wrote: This will solve your generic detection issue.
>[1#] ReFUD Gen:Variant,Razy, Bary,Zusy,Kazy,Conjor,Win32:Evo-gen [Susp]
The thing that I figured out for free is probably the same thing this dude is selling for $25. Like anyone with a brain is gonna pay for that shit, come on man. I should release my own tutorial for free on how I did it.
(Aug 11, 2018 01:44 AM)DafforDucc Wrote: The thing that I figured out for free is probably the same thing this dude is selling for $25. Like anyone with a brain is gonna pay for that shit, come on man. I should release my own tutorial for free on how I did it.
Fuck you!
(Aug 11, 2018 01:52 AM)FuxXER Wrote: Fuck you!
You know I saw your thread earlier when I was trying to figure this out, and I considered buying it, but $25 is ridiculous. I already spent that much on my crypter, I don't want to spend that much more on some basic ass method. If it was $10-$15 I would've bought it probably.
Aug 11, 2018 04:52 AM
(This post was last modified: Aug 11, 2018 04:54 AM by 3DES.)
If your crypt isnt FUD without icon/assembly you have terrible crypt.
(Aug 11, 2018 01:44 AM)DafforDucc Wrote: The thing that I figured out for free is probably the same thing this dude is selling for $25. Like anyone with a brain is gonna pay for that shit, come on man. I should release my own tutorial for free on how I did it.
You cant bypass shit, nobody gives a shit about your shitty .NET crapware, dyncheck with internet you mentally challenged idiot if you dont believe me.
(Aug 11, 2018 01:44 AM)DafforDucc Wrote: The thing that I figured out for free is probably the same thing this dude is selling for $25. Like anyone with a brain is gonna pay for that shit, come on man. I should release my own tutorial for free on how I did it.
When are you releasing ur own tutorial? could you plz pm about this. would appreciate it, thanks
Aug 11, 2018 08:44 AM
(This post was last modified: Aug 11, 2018 08:50 AM by Twistd.)
The detections you describe are heuristic detections, they are based on behaviour which can be either codeflow or api chains being detected scantime.
If you wish to get rid of these detections you need to change the main codeflow codeflow. Another cheap way that can help is adding a string table to the executable in resources, just clone from a different legit file.
Like mentioned above, scantime isnt really the challenge here, the challenge is full runtime bypass.
People claiming you need to use an "HQ" icon are just simply wrong. You shouldnt need to use an icon at all.
My experience with removing detections comes from asm and c\c++, if you're using programming managed code it might be different.
You're saying you've tried a slew of RAT/Crypter combinations and end up with the same cruddy results? Sounds like you're using cruddy programs with cruddy crypters. 8/30 detections is still terrible. If your getting tons of detections scantime, the second your file drops/is executed, it will be almost instantly deleted. I recommend investing more than $25 in a crypter. A private stub crypter is ideal, but there are decent and affordable crypters out there like DataProtector.
(Aug 11, 2018 11:21 PM)joleyman22 Wrote: You're saying you've tried a slew of RAT/Crypter combinations and end up with the same cruddy results? Sounds like you're using cruddy programs with cruddy crypters. 8/30 detections is still terrible. If your getting tons of detections scantime, the second your file drops/is executed, it will be almost instantly deleted. I recommend investing more than $25 in a crypter. A private stub crypter is ideal, but there are decent and affordable crypters out there like DataProtector.
How about donating to my crypter fund? I don't have fifty fucking dollars to drop on some dude's recoding of another crypter. Nothing that the kids on HF release is worth more than thirty dollars. It's all the same recodes, and I could do it myself with ease if I had the free time to make my own.
Unfortunately I have classes, and a life to live. 🤝
You are a fucking idiot - get the hell off this forum.
sas
(Aug 12, 2018 04:58 AM)Tyler Durden. Wrote: You are a fucking idiot - get the hell off this forum.
Okay but why though? What's your argument for that? Or are you just going to say words without any reasoning to back it up, cause you're a fucking idiot yourself?
(Aug 11, 2018 01:44 AM)DafforDucc Wrote: The thing that I figured out for free is probably the same thing this dude is selling for $25. Like anyone with a brain is gonna pay for that shit, come on man. I should release my own tutorial for free on how I did it.
How did you do it? 🤗
|
![[Image: ziLXlil.jpg]](https://i.imgur.com/ziLXlil.jpg)
