Just wondering what are all the ways to make a file undetected without the source?
Here are some
- Packing - Binding - Crypting - Hex modifying - Packing, then removing the packers headers. - Changing the entry point. - Using something like code pervertor which can replace instructions in the file with other instructions which will do the same thing.
Can anybody else think of any other methods?
belgther
Jan 11 2005, 03:15 PM
i have an idea: adding codes so that it kills AV or adds itself to the trusted list of the firewall software to bypass them
relax
Jan 11 2005, 04:45 PM
QUOTE(belgther @ Jan 11 2005, 03:15 PM)
i have an idea: adding codes so that it kills AV or adds itself to the trusted list of the firewall software to bypass them
not much usefor virus scanners which actual scan files in a "live" state
belgther
Jan 11 2005, 04:58 PM
QUOTE(relax @ Jan 11 2005, 05:45 PM)
QUOTE(belgther @ Jan 11 2005, 03:15 PM)
i have an idea: adding codes so that it kills AV or adds itself to the trusted list of the firewall software to bypass them
not much usefor virus scanners which actual scan files in a "live" state
ok than instead of being lazy, we can write our own virus/trojan so the AV doesn't detect it... i know, he means modifying an existing file, but this is such a lazy method...
Pseudonym
Jan 12 2005, 03:38 AM
Well you want to add some code to the file that will kill the A/V right?
Okay, so we have our detected file, and we have our A/V killer code, we add it together. We send it to the computer but.... How are we going to open it? In order to kill the A/V you have to open the file, so that the A/V killer code is executed, but you cannot do that because it is attached to a file which is detected.
That method won't work, unless you sent an undetected A/V killer first than executed that.
Also aswell as file packers, file protectors can make files undetected some times.
Make your own packer? I know the list so far has been quick script-kiddie ways of getting around AV, but as crafty noted most packers/encrypters these days are picked up by up-to-date good AV's.
In case someone's interested or looking for more info here is a tutorial on writing your own packer
Grtz, droppunx
ScOOt3r
Jan 14 2005, 03:23 PM
I often Hex Edit files myself, change header or just mix something up and 99.9% of the time it becomes undetctable by any AV.. just wanna let you guys know.
Thanks Drop that is a great tut.. hope some will learning something from it. Gonna Bookmark that one!
ScOOt3r!
jead99
Jan 14 2005, 06:48 PM
Agree that hex editing works in many cases but it would be nice to make your own packer like in the tut provided by droppunx.
Btw. thanks for the link, just what i've been looking for to get started on this project.
crafty
Jan 14 2005, 11:15 PM
to make bifrost and any trojan undetected the simple and easiest way is to find a win32 PE .exe file source code protection software, thats the best hint i can give you.
example: search google for "win32 source code protection", download
test your virus/trojan at www.virustotal.com
if you still need help msg me.
Eyeless
Jan 17 2005, 11:08 PM
LOL I still dont know why people think it is script kiddish to not write there own software, if we take it to the extreme using c++ or VB etc is script kiddish you would have to create your own scripting language not to use someone elses creation... I say find the fastest meathod using the avaliable assets to you to get the result you want. Its only script kiddish if you are doing it without a purpose and have no idea why it works.
Wow, very nice list you got there. I think going in and hexing the detected part is pretty easy, It only takes me 4-5 min to do a server per AV, and works 95% of the time.
crafty
Jan 18 2005, 04:41 AM
ive found PC Guard For Win32 or PC Guard for DOS, works the best...
beats all AV in one hit...
herman2k
Jan 20 2005, 10:23 PM
QUOTE(Spiffypat @ Jan 18 2005, 01:54 AM)
Wow, very nice list you got there. I think going in and hexing the detected part is pretty easy, It only takes me 4-5 min to do a server per AV, and works 95% of the time.
I think u dont know what realy up Your hexing method is not more sure. Maybe AV´s same Norton
Some Av´s (example KAV) changing by famous RAT´s (bifrost) the signature after updates.
And why change same AV´s the signature, because lot of people use the Hex method, (before avpoffset,ok not more work)and today like offsetfinder AVdevil.
And second, not all Signature´s can you easy change.i mean same signatures are hard in code and when you change this... the file is then broken.
ive found PC Guard For Win32 or PC Guard for DOS, works the best...
beats all AV in one hit...
Do you have the serial for this soft ?
WARNED FOR THE LAST TIME ....read the rules account disabled for 10 days for serial request
lev
Jan 21 2005, 05:34 PM
QUOTE(Pseudonym @ Jan 11 2005, 06:43 AM)
Just wondering what are all the ways to make a file undetected without the source?
Here are some
- Packing - Binding - Crypting - Hex modifying - Packing, then removing the packers headers. - Changing the entry point. - Using something like code pervertor which can replace instructions in the file with other instructions which will do the same thing.
The reason why i dont make the link puplic is, because when the website master see that, that i post the link here, maybe he dont make more puplic his secrets!
His website is for the AV producer
AdmiralB
Jan 22 2005, 01:47 AM
i find using a combination of packing and perhaps crypting or binding best to avoid detection
Progressor
Jan 23 2005, 08:58 AM
QUOTE
2. For KAV ist good the NOP method with changing the entrypoint.
No, it doesn't work for KAV. You better add section to file or try opcode substitute.
Lie8
Jan 27 2005, 08:34 AM
hmmm .... the pcguard method works .... but the size gets bigger of the server .... not tested much but it skips well .... thnx for the info.
matiano
Feb 9 2005, 05:15 PM
QUOTE(Progressor @ Jan 23 2005, 08:58 AM)
QUOTE
2. For KAV ist good the NOP method with changing the entrypoint.
No, it doesn't work for KAV. You better add section to file or try opcode substitute.
The NOP method does work with standart scan KAV!
Lie8
Feb 9 2005, 05:34 PM
@matiano,
pmed u twice ... can u pls PM me the top secret link of urs or add me in MSN .... thnx inadvance.
matiano
Feb 10 2005, 10:16 AM
QUOTE(Lie8 @ Feb 9 2005, 05:34 PM)
@matiano,
pmed u twice ... can u pls PM me the top secret link of urs or add me in MSN .... thnx inadvance.
sorry i dont trust u because u have only 2 postings
jase_uk
Feb 10 2005, 10:41 PM
lol I im still working on making my file UD.
I have a program called stealth tools 2 but its not much help to be honest.
I might try and use some software protecters, but i mean if anyone has any good ideas then let us know.
I tryed cutting up the server and scanning each little bit, but not a single bit of it came as a virus, so i dunno what was going on there.
i mean if anyone knows anything about hex editing then let us know.
rageinc
Feb 12 2005, 07:45 AM
Simply put, i have the best way to get around virus scanner detection. It is a program called ExeStealth. It is designed to protect your program against it being cracked, but it works great to change the way a .exe file looks. It also has a special option to make ur own key or somthin i havent used this option much. If u cant find it tell me and ill post it on some server somewhere. Peace.
Lie8
Feb 12 2005, 11:17 AM
QUOTE(matiano @ Feb 10 2005, 05:16 PM)
QUOTE(Lie8 @ Feb 9 2005, 05:34 PM)
@matiano,
pmed u twice ... can u pls PM me the top secret link of urs or add me in MSN .... thnx inadvance.
sorry i dont trust u because u have only 2 postings
hmm .. bro PMed you .. pls reply this time
@rageinc,
from what ur telling i can understand it's something like PCGuard ... i already tried PC guard .... but can't get it working, it corrupts already packed servers .... i'll try this today ....
Lie8
Feb 12 2005, 04:45 PM
@rageinc,
tried the exestealth 2,75a .... but didn't work .... may be there is something speacial settings .. will pls mention them?
upload to virustotal.com to check if undetectable...
crafty
Feb 14 2005, 07:41 AM
PC Guard is now detected the following: Antivirus Version Update Result AntiVir 6.29.0.11 02.11.2005 no virus found AVG 718 02.10.2005 no virus found BitDefender 7.0 02.13.2005 no virus found ClamAV devel-20050130 02.14.2005 Trojan.Downloader.Delf-49 DrWeb 4.32b 02.14.2005 Trojan.DownLoader.393 eTrust-Iris 7.1.194.0 02.13.2005 no virus found eTrust-Vet 11.7.0.0 02.14.2005 no virus found Fortinet 2.51 02.12.2005 no virus found F-Prot 3.16a 02.10.2005 no virus found Kaspersky 4.0.2.24 02.14.2005 no virus found NOD32v2 1.998 02.12.2005 no virus found Norman 5.70.10 02.11.2005 no virus found Panda 8.02.00 02.13.2005 no virus found Sybari 7.5.1314 02.13.2005 Downloader-PP Symantec 8.0 02.13.2005 no virus found
Archphases program (pib) is also detected as shown below
Antivirus Version Update Result AntiVir 6.29.0.11 02.11.2005 no virus found AVG 718 02.10.2005 no virus found BitDefender 7.0 02.13.2005 BehavesLike:Trojan.Downloader ClamAV devel-20050130 02.14.2005 no virus found DrWeb 4.32b 02.14.2005 no virus found eTrust-Iris 7.1.194.0 02.13.2005 no virus found eTrust-Vet 11.7.0.0 02.14.2005 no virus found Fortinet 2.51 02.12.2005 no virus found F-Prot 3.16a 02.10.2005 could be infected with an unknown virus Kaspersky 4.0.2.24 02.14.2005 no virus found NOD32v2 1.998 02.12.2005 probably unknown CRYPT.WIN32 virus Norman 5.70.10 02.11.2005 no virus found Panda 8.02.00 02.13.2005 no virus found Sybari 7.5.1314 02.13.2005 no virus found Symantec 8.0 02.13.2005 no virus found
in conclusion i have not found a program which can make undetectable files as yet but will keep looking
Lie8
Feb 14 2005, 06:25 PM
@crafty,
thnx for the tut .... but could u pls give some info for v4 .... v5 is still unregged and so it shows demo limitations while executed .... also, will it corrupt and already packed server?
@archphase,
can't connect to site .... but eager to test the app.
@rageinc,
waiting if u have any good suggestions in ur sleeves for Exestealth 2.75
crafty
Feb 15 2005, 05:28 AM
ok it didn't take me long as i have found a new method to get past 99.9% of AV only Sybari version 7.5.1314 can detect a virus/trojan/downloader
so yes it is still possible, just keep trying people.
any questions PM me
if you are working for or with any government or antipiracy or antivirus company DO NOT PM ME
Lie8
Feb 18 2005, 06:07 PM
hmm ... any link for the "archphase" 's pid ? want to check it.
pcguard32 .... really bugs with the annoying demo messge .... and still didn't manage to do da job with v4.06
looks like i'll have to go back to AV devil/hex edit again ... but so hard
censorednet goes down as well though, people are always playing packeting games,
Lie8
Feb 22 2005, 07:19 PM
thnc arc .... i got it .... and matiano .... many man thnx
toe
Feb 24 2005, 09:21 AM
i used the demo of pc guard 5 and it works fine mostly undetected. it works fine but u can only run it 20 times coz of the demo
yuck_fou
Jun 21 2005, 03:50 PM
Any ideas where[Edited by GSecur: Do not even hint at warez request] Or does anybody know any other software that is as good as PC Gurad?? I've trird a few but they seem to wreck the server.exe.
yuck_fou
Jun 22 2005, 09:25 PM
QUOTE(yuck_fou @ Jun 21 2005, 03:50 PM)
Any ideas where[Edited by GSecur: Do not even hint at warez request] Or does anybody know any other software that is as good as PC Gurad?? I've trird a few but they seem to wreck the server.exe.
Ha ha ha sorry Gsecur! I thought i'd test to see how well the moderators work here!
But on another note...I guess nobody really lets on about which software will really do the trick because if they did the AV spys would catch on *click*
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
LOL I still dont know why people think it is script kiddish to not write there own software, if we take it to the extreme using c++ or VB etc is script kiddish you would have to create your own scripting language not to use someone elses creation... I say find the fastest meathod using the avaliable assets to you to get the result you want. Its only script kiddish if you are doing it without a purpose and have no idea why it works.
Or does anybody know any other software that is as good as PC Gurad?? I've trird a few but they seem to wreck the server.exe. 
