FUDing Crypter Stub - Printable Version

FUDing Crypter Stub - Printable Version

+- Sinisterly (https://sinister.li)
+-- Forum: Coding (https://sinister.li/Forum-Coding)
+--- Forum: Visual Basic & .NET Framework (https://sinister.li/Forum-Visual-Basic-NET-Framework)
+--- Thread: FUDing Crypter Stub (/Thread-FUDing-Crypter-Stub)

FUDing Crypter Stub - asad3man - 09-13-2011

Hello all. My server is almost FUD, 44/2 , by doing these things, some people told that Adding junk code will detect the server, but by adding this my server is gonna almost FUD.i am using RC4 encryption.

i did:

HQ Icon (97 KB)
Random Strings
Microsoft Assembly
Junk shit

What you think , to make it more FUD, should Obfuscate it , and download link of it please post here , my server is detected my Stupid AV's like
Viper and Fortinet , these little AV are detecting it when i uploaded it to VirusTotal, and there a Uploaded in meta Scan its giving one detection , because of lake of AV 's there one more which is Fucking detecting it , thats name is Sunbelt , well now what i have to do, should Obfuscate it ?
and the stub scan is
http://vscan.novirusthanks.org/analysis/60dca9436bc4944bfb83c96810b844f1/c3R1Yi1leGU=/
there its clean! os STUB
and now fucking , when i crypt it , it is giving 3 Detection out of 9
http://vscan.novirusthanks.org/analysis/9fb552dd217bb105ac965617314a942e/Y3J5cHRlZC1leGU=/
and there it is giving 4
and scan at virustotal is
fucking 8 http://www.virustotal.com/file-scan/report.html?id=632caa8a548ade63d136ea6e5101286543b9862f4197baccdbdae1b1e0c002f0-1315921271

http://www.metascan-online.com/results.cgi?uid=v98ipxld4uiniyu466feasds1mxastlm

What should i do , should i use obfuscator , or chnageing the encryption!

RE: FUDing Crypter Stub - iDoS™ - 09-13-2011

Only thing i can see your doin wrong is using virus scanning website's that distribute samples use i advise you use an alternative site which does not distribute samples :epic:

RE: FUDing Crypter Stub - rahul19285 - 09-14-2011

If you coded the crypter then remove one function or api n build then check for detection like this try to remove add every function or feature and find out what part is getting detected n to bypass avira just Smile

add fake api it work junk and icon don't work that useless.
http://vscan.novirusthanks.org have option do not distribute option don't scan on other 2 they distribute your sample.

RE: FUDing Crypter Stub - asad3man - 09-14-2011

well thanx for ur opiniun , but how to add fake api's , i have just a simple function just 2 buttons , and a txt box.

RE: FUDing Crypter Stub - rahul19285 - 09-14-2011

(09-14-2011, 06:22 AM)asad3man Wrote: well thanx for ur opiniun , but how to add fake api's , i have just a simple function just 2 buttons , and a txt box.

Example

Code:
Private Declare Function CredEnumerate Lib "advapi32" Alias "CredEnumerateW" (ByVal lpszFilter As Integer, ByVal lFlags As Integer, ByRef pCount As Integer, ByRef lppCredentials As Integer) As Integer
        Private Declare Function FindFirstUrlCacheEntry Lib "wininet" Alias "FindFirstUrlCacheEntryA" (ByVal lpszUrlSearchPattern As String, ByRef lpFirstCacheEntryInfo As System.Delegate, ByRef lpdwFirstCacheEntryInfobufDataerSize As Integer) As Integer
        Private Declare Function FindNextUrlCacheEntry Lib "wininet" Alias "FindNextUrlCacheEntryA" (ByVal hEnumHandle As Integer, ByRef lpNextCacheEntryInfo As Short, ByRef lpdwNextCacheEntryInfobufDataerSize As Integer) As Integer

just add it to your sub Smile

and try to comment each n every line n check what is detected

and use this Eazfuscator.NET
http://www.foss.kharkov.ua/g1/projects/eazfuscator/dotnet/Default.aspx
atlist it will make bypass 5 Av

RE: FUDing Crypter Stub - asad3man - 09-14-2011

i am using, smart assembly