[gigajew]

In this code sample I tested a theory that you could call Windows API using encrypted strings in C#, and the proof of concept is here. Here I am defining two secure strings, one is "user32.dll" and the other "MessageBoxA", and then using LoadLibrary to load user32.dll and GetProcAddress to get the MessageBoxA procedural address. Afaik this is a first of it's kind, I could be wrong. I've never seen it before though.

This may or may not bypass or throw off AV scanners runtime scans.

[NYANxCAT]

Great idea I think it could bypass av scantime easily.

Thanks for sharing this with us. Glad you still posting here.

[Jurashit]

Code

private SecureString ConvertToSecureString(string password)
{
    if (password == null)
        throw new ArgumentNullException("password");

    var securePassword = new SecureString();

    foreach (char c in password)
        securePassword.AppendChar(c);

    securePassword.MakeReadOnly();
    return securePassword;
}

:)

[gigajew]

I implemented this in my open-source 64-bit traditional RunPE available on Github. It brought static detection down to 2/26, but without any evasions the dynamic detection was rated 60/100 using the reverse.it service.