[freeman7777]

Hi,

I have written very well working data grabber in C# .NET 8.0 AOT (machine code) that I tested under different antiviruses (Windows Defender and ESET) on Windows 10/11. I'm finishing dropper for this program (also C#) which does:
a) download data grabber (it's encrypted with my algortihm), decrypt it, then save it
b) add it's path to CurrentVersion\Run in windows registry
c) start the process
Between these theps there is a lot of bullshit code running that looks legitimate and some Task.Delay() for few seconds, but sometimes antiviruses stop this program and label it as a troyan. Even with using hackerai.co I'm having some difficulties creating an algorithm that would fool antiviruses. I tried making .lnk (shortcut) in Shell:Startup but it made things even worse.
AI suggests some sort of advanced process hollowing for the data grabber, but maybe there is something simpler... any ideas how to make it better ?

[freeman7777]

Wow I made it. Working architecture for Windows 10/11 is this:

A) Implementer that looks like a document and not a program because it has different icon (for example Excel icon). When it's clicked it unpacks (from it's resource) program (B) which is Uploader. It also adds some info to windows registry but NOT CurrentVersion\Run, nor Shell:Startup, but it uses Task Scheduler instead. Also each step of implementation and running the Updater must be delayed as much as possible so that modern AVs will not see all this as a threat.
B) Updater downloads screen grabber / key logger from C2 (server) , unpacks it, runs it and makes sure it is running (in infinite loop, but not too often). Using some decoy code that does something that looks legitimate probably also helps. Updater also checks if there is new version of keylogger and it downloads it.
C) The keylogger \ screen grabber itself. It uses WinAPI for detecting key strokes and when program windows are switched and sends all this stuff to C2. WinAPI hooks are implemented using native pointers instead of delegates.

Configuration (that keeps address to C2) is kept encrypted on anonymous Telegram.

All of this has been done in C# AOT (machine code, NOT managed!) in Visual Studio with help of AI (for example HackerAI.co). I worked my guts out to have this completed and it works flawlessly now without being detected by AVs.

I offer paid consulatations.