[NYANxCAT]

You all have a problem with WD, I created this video to show you how to bypass WD+Internet easily using open-source runPE class even if you are a beginner!

I also used the browser to download the payload into the WD machine instead of just copy+paste it from VM to another just to simulate the real scenario.

This method will work on .NET or Native files. I did my best to make this tutorial as simple as possible(just 1 class, no external lib, no encryption..etc).

And again.. copy+paste this tutorial won't give you a FUD result, Take the idea and be creative.

Enjoy watching.

---

Scantime (Click to View)

---

[kausar0707]

Thanks for sharing dude :)

[Aekras1a]

Awesome guide, thank you NYAN, and congratulations on getting married ^^

[1stetcgoldmedal]

I respect the spirit of sharing
A great friend for beginners

[Mirakuru]

Thank you for share mate. :)

[Kindness]

Very informative  and useful tutorial.Thank you  so much brother.
Congratulations on getting married.May Allah bless you brother <3

[stringsnstuff]

Hello thank you very much Nyan, I have implemented this into my personal runtime/scantime crypter coded in C and it helped for sure. I saw you defined a string for path and a string for decrypting Base64. Do you actually use the Base64 string or do you only have it defined and that's it?

[NYANxCAT]

Hello thank you very much Nyan, I have implemented this into my personal runtime/scantime crypter coded in C and it helped for sure. I saw you defined a string for path and a string for decrypting Base64. Do you actually use the Base64 string or do you only have it defined and that's it?

hello, yes I used it by converting the string to byte array.

[stringsnstuff]

hello, yes I used it by converting the string to byte array.

Alright sorry for not being clear enough. My question was what did you do with the byte array? I only see the byte array being defined I don't see you using it anywhere.

[Irrelewanted]

Alright sorry for not being clear enough. My question was what did you do with the byte array? I only see the byte array being defined I don't see you using it anywhere.

Correct me if I'm wrong Nyan, but he executed the "byte array" which was the binary of the RAT (stub) itself.
How he executes the byte array, is a whole and really advanced other story. Look up "process hollowing" on Google for more information on how "RunPE" executes it's code into a newly suspended process.

Great video though. Quick, simple and functioning.

[stringsnstuff]

Correct me if I'm wrong Nyan, but he executed the "byte array" which was the binary of the RAT (stub) itself.
How he executes the byte array, is a whole and really advanced other story. Look up "process hollowing" on Google for more information on how "RunPE" executes it's code into a newly suspended process.

Great video though. Quick, simple and functioning.

Yeah I know how RunPE works. I know whats going on. He is using the byte array to execute the server. Was confused at first. Thank you for your reply. Was confused because I'm not familiar with this coding language as I am a c++ programmer.

[Irrelewanted]

Yeah I know how RunPE works. I know whats going on. He is using the byte array to execute the server. Was confused at first. Thank you for your reply.

No problem, I'm glad that I cleared that up for you.

[Obistone]

Was confused because I'm not familiar with this coding language as I am a c++ programmer.

You should be a little bit familiar with C# as it is in the C family, just like C++.

[RedirectMe]

C# is not like C++ or C. It's more like Java

[kiffu]

Thanks for sharing, i tried but WD is detecting, i am not worried about other AVs but i just want to bypass WD, please pm me if you can help and let me know what changes if i do will help me bypass WD.

Thank You