57 replies to this topic

[vnet576]

i posted what av -> antivir (http://www.hbedv.com)
maybe you don't know it.

<{POST_SNAPBACK}>

Thats fine, did you list what version of the AV? Did you mention what kind of virus did it detect it as?

[tibbar]

well all AV are now beaten... unfortuntely for u guys, i wont release it until it's got a polymorphic stub...

[jead99]

well all AV are now beaten... unfortuntely for u guys, i wont release it until it's got a polymorphic stub...

<{POST_SNAPBACK}>

Nice work tibbar Perhaps you could give ppl a few tips on what you did ?

[tibbar]

several things:

1) encrypt TEXT, DATA and .rsrc sections

2) at original EP, copy first x bytes in a buffer at end of file and replace with a undetected detour to my stub EP.

3) stub must decrypt the above 3 sections then restore original EP code, then jmp to original EP.

[Chris]

Great work Tibbar,

Sorry if this seems a little dense mate but doesnt this mean that the file would still be detected at run time? As the code will still be run once decrypted?

And sorry if I forgot any s' my s key is broken so I copy pasted them all in.

[tibbar]

well if you were to suspend the packed program after execution and scan the memory, you would match a signiture.

but as it happens no AV does this, except perhaps for Norman Sandbox, but thats not really an AV.

[extreme]

Can't you just release example code, with a simple XOR encryption or something??
That would make your polimorphic engine permanently stealtht also..

[tibbar]

latest release now uses a Linear Congrential Generator to create random sequence to encrypt with.

This works as follows:

x_(r+1) = a*x_r + c modulo m

x_0 = seed which is generated by looking at the system clock.

Working now 100% on all AV. All that remains is a polymorphic stub, and then it can be publicly released.

[Erra]

Just thought I would update this;

Things I used this on are now detected in the following AV's I have tested

Mcafee
Sophos
Symantec
AVG

I havent tested any others.

Using Codecrypt 0.1

Didnt use to find them, but they must have caught up now

[andi1983]

it destroys packed filez for example with upx, is there a way to fix it?

[Serhat]

it destroys packed filez for example with upx, is there a way to fix it?

<{POST_SNAPBACK}>

then use upx -d to decompress it and compress it with this one..

Serhat

[andi1983]

it destroys packed filez for example with upx, is there a way to fix it?

<{POST_SNAPBACK}>

then use upx -d to decompress it and compress it with this one..

Serhat

<{POST_SNAPBACK}>

yeah that would be no problem if i had the original filez

[tibbar]

enough has been said for the time being here. thread is just attracting thankers and post count junkies.

closed for now.