[_CASP3R_]

Hello, So basically i am getting a detection, After some digging i found out what is getting detected. Its this peace of code below.
How do i get around this detection? I have tried renaming the value and that didn't do anything. I have also tried copying the file to the startup folder.... Same detection. Any help is appreciated.

Code

using (RegistryKey key = Registry.CurrentUser.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", true))
               {
                   key.SetValue("conhost", "\"" + tempPath + text + "\"");
               }

Best Regards, CASPER  🤝  🤝

[Nick (Name)]

You should try another form of startup, there’s plenty of other methods out there but using the registry is probably not the best idea. If you’re not code signing, AV’s are going to flag any 32bit executable attempting to write in this extremely common startup location.

[NYANxCAT]

Try this

https://www.andreafortuna.org/dfir/malwa...echniques/

[_CASP3R_]

You should try another form of startup, there’s plenty of other methods out there but using the registry is probably not the best idea. If you’re not code signing, AV’s are going to flag any 32bit executable attempting to write in this extremely common startup location.

Dont u need a certificate to code sign? Im pretty sure some crypters have them but i dont wanna crypt my file.

---

Try this

https://www.andreafortuna.org/dfir/malwa...echniques/

Thanks man! Ill check it out.

[NYANxCAT]

n.p man, I'm glad it helped