Login Register






FUDing Crypter Stub filter_list
Author
Message
FUDing Crypter Stub #1
Hello all. My server is almost FUD, 44/2 , by doing these things, some people told that Adding junk code will detect the server, but by adding this my server is gonna almost FUD.i am using RC4 encryption.

i did:
  1. HQ Icon (97 KB)
  2. Random Strings
  3. Microsoft Assembly
  4. Junk shit

What you think , to make it more FUD, should Obfuscate it , and download link of it please post here , my server is detected my Stupid AV's like
Viper and Fortinet , these little AV are detecting it when i uploaded it to VirusTotal, and there a Uploaded in meta Scan its giving one detection , because of lake of AV 's there one more which is Fucking detecting it , thats name is Sunbelt , well now what i have to do, should Obfuscate it ?
and the stub scan is
http://vscan.novirusthanks.org/analysis/...1Yi1leGU=/
there its clean! os STUB
and now fucking , when i crypt it , it is giving 3 Detection out of 9
http://vscan.novirusthanks.org/analysis/...lZC1leGU=/
and there it is giving 4
and scan at virustotal is
fucking 8 http://www.virustotal.com/file-scan/repo...1315921271

http://www.metascan-online.com/results.c...ds1mxastlm


What should i do , should i use obfuscator , or chnageing the encryption!
(This post was last modified: 09-13-2011, 02:55 PM by toturer25.)
- asad3man

Reply

RE: FUDing Crypter Stub #2
Only thing i can see your doin wrong is using virus scanning website's that distribute samples use i advise you use an alternative site which does not distribute samples :epic:

Reply

RE: FUDing Crypter Stub #3
If you coded the crypter then remove one function or api n build then check for detection like this try to remove add every function or feature and find out what part is getting detected n to bypass avira just Smile add fake api it work junk and icon don't work that useless.
http://vscan.novirusthanks.org have option do not distribute option don't scan on other 2 they distribute your sample.

Reply

RE: FUDing Crypter Stub #4
well thanx for ur opiniun , but how to add fake api's , i have just a simple function just 2 buttons , and a txt box.
- asad3man

Reply

RE: FUDing Crypter Stub #5
(09-14-2011, 06:22 AM)asad3man Wrote: well thanx for ur opiniun , but how to add fake api's , i have just a simple function just 2 buttons , and a txt box.
Example
Code:
Private Declare Function CredEnumerate Lib "advapi32" Alias "CredEnumerateW" (ByVal lpszFilter As Integer, ByVal lFlags As Integer, ByRef pCount As Integer, ByRef lppCredentials As Integer) As Integer Private Declare Function FindFirstUrlCacheEntry Lib "wininet" Alias "FindFirstUrlCacheEntryA" (ByVal lpszUrlSearchPattern As String, ByRef lpFirstCacheEntryInfo As System.Delegate, ByRef lpdwFirstCacheEntryInfobufDataerSize As Integer) As Integer Private Declare Function FindNextUrlCacheEntry Lib "wininet" Alias "FindNextUrlCacheEntryA" (ByVal hEnumHandle As Integer, ByRef lpNextCacheEntryInfo As Short, ByRef lpdwNextCacheEntryInfobufDataerSize As Integer) As Integer
just add it to your sub Smile and try to comment each n every line n check what is detected

and use this Eazfuscator.NET
http://www.foss.kharkov.ua/g1/projects/e...fault.aspx
atlist it will make bypass 5 Av


Reply

RE: FUDing Crypter Stub #6
i am using, smart assembly
- asad3man

Reply