(Nov 18, 2019 11:28 AM)aerohacker Wrote: What Crypter has a Process Persistence feature same as those used by AntiVirus, making the AV process "impossible" to kill/terminate and/or suspend a RAT's process using any Process Manager Tool like Windows Task Manager, Process System, Process Monitor and/or Process Hacker (Even with Administrador privileges) or any BotKill.
"Unable to terminate process.exe (PID XXX). Acess is denied."
Some Process Persistence that hooks in Kernel Mode Driver.
If a AntiVirus can use this technique so a Crypter can or could uses too, right?!
Yes you could. Anti-viruses use kernel mode drivers to hook all terminate process requests (and many more), and they deny/modify all of them that have to do with the antivirus processes and come from the user.
Now, of course you can buy a signature for your driver (which is mandatory to spread it), but the problem is that it costs a lot of $$ and it will be flagged in a few days at best - not to mention that you need to make it through Microsoft's approval process.
Of course, there is the option of using a driver exploit in order to map your driver that way, but many of these vulnerable drivers work up to a specific Windows version, and many of these exploits due to their instability tend to end up on a nice BSOD quite a few times.
In short: It isn't worth it, because the problems from such a technique heavily out-weight the benefits.
(Nov 18, 2019 04:07 PM)Cyber Coder Wrote: is funny how you make the same threads every few months but never get a satisfying answer
insanity : doing the same thing over and over again expecting s.hit to change
This is one way to see it. Another one is that he is persistent enough to get an answer, which depending on the case it's not a bad skill to have 🙂
