Windows Defender Is Getting Quick

DedSpace · 10-09-2019, 11:08 AM

I've been generating meterpreter reverse TCP payloads, hosting them on my LAN, downloading them on a MS Edge VM to run. Check that out if you don't know about it, it's very useful for things like this. The first couple of times, it worked like a charm. But now I get Windows Defender notifications, and it gets deleted before I can run it. It's worth noting that I'm generating a 64 bit payload in C encoded with 7 rounds of XOR, put into a template I wrote myself. Windows Defender went from being fine to being a pain in the space of an hour. Has anyone else experienced this, or did I get caught out by bad timing? Finally, is it worth biting the bullet and paying for a crypter?

Cr3aTor · 10-09-2019, 12:03 PM

(10-09-2019, 11:08 AM)DedSpace Wrote: Windows Defender went from being fine to being a pain in the space of an hour. Has anyone else experienced this, or did I get caught out by bad timing?

Yeah I've also noticed that Windows Defender is becoming more and more effective. However, I am not having much trouble with it.
Have you tried running custom shellcode or something else other than meterpreter?

(10-09-2019, 11:08 AM)DedSpace Wrote: Finally, is it worth biting the bullet and paying for a crypter?

I don't think it's worth buying one, but it's definitely worth creating one. The latter is more effective since you've coded it, therefore you can easily customize it in the future.
Most of the crypters on the market aren't going to help you on the long term, because if you can buy it there is also others that can. So in time, it becomes identified and probably detected.
I would recommend to buy one if you don't have the time to code and want something quick to do the job for you, without having much insight on what's happening.

DedSpace · 10-09-2019, 03:13 PM

(10-09-2019, 12:03 PM)Cr3aTor Wrote: Have you tried running custom shellcode or something else other than meterpreter?

Yeah, the plain old reverse TCP or HTTP seem to work better, but I do like the functionality of meterpreter.

(10-09-2019, 12:03 PM)Cr3aTor Wrote: I don't think it's worth buying one, but it's definitely worth creating one. The latter is more effective since you've coded it, therefore you can easily customize it in the future.
Most of the crypters on the market aren't going to help you on the long term, because if you can buy it there is also others that can. So in time, it becomes identified and probably detected.
I would recommend to buy one if you don't have the time to code and want something quick to do the job for you, without having much insight on what's happening.

I see what you mean, popular ways of doing things are always going to be the first to get caught. I have the time at the moment, but not so much the know-how. I know that I should create what is called a "stub" program which contains the encrypted payload, decrypts, and executes it. It's the encryption I think I'll struggle with - how secure should it be? I was thinking of using a symmetric key algorithm, but will an AV pick up on this immediately? I'll have to put the key in the stub regardless of what encryption method I choose, it just seems a little transparent

chuko101 · 10-09-2019, 06:54 PM

Live | 99.194.117.26:61851 | United States | Hinesville | GA | 31313 | Checked at Shopsocks5.com
Live | 107.175.220.173:7886 | United States | Buffalo | NY | 14221 | Checked at Shopsocks5.com
Live | 66.158.213.28:36077 | United States | Tallahassee | FL | 32304 | Checked at Shopsocks5.com
Live | 99.194.28.123:39162 | United States | Efland | NC | 27243 | Checked at Shopsocks5.com
Live | 66.33.210.201:44252 | United States | Brea | CA | 92821 | Checked at Shopsocks5.com
Live | 208.107.252.226:38072 | United States | Grand Forks | ND | 58201 | Checked at Shopsocks5.com
Live | 99.194.116.180:61493 | United States | Richmond Hill | GA | 31324 | Checked at Shopsocks5.com
Live | 66.244.113.200:19756 | United States | Ellettsville | IN | 47429 | Checked at Shopsocks5.com
Live | 107.175.220.173:6108 | United States | Buffalo | NY | 14221 | Checked at Shopsocks5.com
Live | 68.197.27.246:18483 | United States | Lake Hopatcong | NJ | 07849 | Checked at Shopsocks5.com
Live | 45.56.91.119:30287 | United States | Fremont | CA | 94536 | Checked at Shopsocks5.com
Live | 66.33.210.201:55612 | United States | Brea | CA | 92821 | Checked at Shopsocks5.com
Live | 66.33.210.201:59976 | United States | Brea | CA | 92821 | Checked at Shopsocks5.com
Live | 107.175.220.173:6378 | United States | Buffalo | NY | 14221 | Checked at Shopsocks5.com
Live | 107.175.220.173:7654 | United States | Buffalo | NY | 14221 | Checked at Shopsocks5.com
Live | 64.90.50.219:64795 | United States | Brea | CA | 92821 | Checked at Shopsocks5.com

Drako · 10-09-2019, 09:34 PM

A user posted a thread about the current overall AV scores (Scores came from https://www.av-comparatives.org/) a few months ago. And surprisingly, Windows Defender was one of the top dogs. I never imagined it would ever become as good as it is now. I guess Microsoft is finally giving one about its users' security!

DedSpace · 10-09-2019, 11:40 PM

(10-09-2019, 09:34 PM)Drako Wrote: A user posted a thread about the current overall AV scores (Scores came from https://www.av-comparatives.org/) a few months ago. And surprisingly, Windows Defender was one of the top dogs. I never imagined it would ever become as good as it is now. I guess Microsoft is finally giving one about its users' security!

DAMMIT. Too big a jump to be machine learning? I imagine there's plenty of training data around, and Windows Defender uploads your downloads to their DB. Check it out:

[Image: Untitled.png]

mothered · 10-10-2019, 03:01 AM

(10-09-2019, 09:34 PM)Drako Wrote: A user posted a thread about the current overall AV scores (Scores came from https://www.av-comparatives.org/) a few months ago. And surprisingly, Windows Defender was one of the top dogs. I never imagined it would ever become as good as it is now. I guess Microsoft is finally giving one about its users' security!

It's certainly come a very long way, since the days of It's first release as Microsoft AntiSpyware.

I'm quite Impressed not only by It's detection rate, but also It's accuracy.

Drako · 10-10-2019, 07:04 PM

(10-09-2019, 11:40 PM)DedSpace Wrote:
(10-09-2019, 09:34 PM)Drako Wrote: A user posted a thread about the current overall AV scores (Scores came from https://www.av-comparatives.org/) a few months ago. And surprisingly, Windows Defender was one of the top dogs. I never imagined it would ever become as good as it is now. I guess Microsoft is finally giving one about its users' security!

DAMMIT. Too big a jump to be machine learning? I imagine there's plenty of training data around, and Windows Defender uploads your downloads to their DB. Check it out:

Well that's called privacy invasion. I didn't know that Windows Defender could do that. Then again, Microsoft could get whatever they wanted off of your system, whenever.

Cr3aTor · 10-10-2019, 08:59 PM

(10-10-2019, 07:04 PM)Drako Wrote: Then again, Microsoft could get whatever they wanted off of your system, whenever.

Well, it's their code after all. They can run whatever they want Biggrin

Defeat · 10-10-2019, 09:26 PM

Yeah last week it fucked me over. It went in and quarantined the file that cracked my Adobe Acrobat... Spent hours figuring out why my PDFs kept crashing. Finally realized it was that bs... Had it cracked for over a year but now it interferes lmao