Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Sponsored by: █ Sparkhost - Hosting Without Compromises! █ Hybrid Performance Web Hosting █ Spark Host Stream Hosting █ Hybrid IRC & IRCd Server Shell Accounts

Hxdef_netkairo_mod (undetected)

Started by netkairo , May 25 2006 02:08 PM

Next

This topic is locked

40 replies to this topic

#1 netkairo

Private First Class

Members
79 posts

Posted 25 May 2006 - 02:08 PM

Antivirus Version Actualizaci�n Resultado
AntiVir 6.34.1.32 25.05.2006 no ha encontrado virus
Authentium 4.93.8 25.05.2006 no ha encontrado virus
Avast 4.6.695.0 24.05.2006 no ha encontrado virus
AVG 386 25.05.2006 no ha encontrado virus
BitDefender 7.2 25.05.2006 no ha encontrado virus
CAT-QuickHeal 8.00 25.05.2006 (Suspicious) - DNAScan
ClamAV devel-20060426 25.05.2006 no ha encontrado virus
DrWeb 4.33 25.05.2006 no ha encontrado virus
eTrust-InoculateIT 23.72.17 25.05.2006 no ha encontrado virus
eTrust-Vet 12.6.2227 25.05.2006 no ha encontrado virus
Ewido 3.5 25.05.2006 no ha encontrado virus
Fortinet 2.77.0.0 24.05.2006 suspicious
F-Prot 3.16c 25.05.2006 no ha encontrado virus
Ikarus 0.2.65.0 24.05.2006 no ha encontrado virus
Kaspersky 4.0.2.24 25.05.2006 no ha encontrado virus
McAfee 4770 25.05.2006 no ha encontrado virus
Microsoft 1.1440 22.05.2006 no ha encontrado virus
NOD32v2 1.1559 25.05.2006 no ha encontrado virus
Norman 5.90.17 24.05.2006 no ha encontrado virus
Panda 9.0.0.4 25.05.2006 Suspicious file
Sophos 4.05.0 25.05.2006 no ha encontrado virus
Symantec 8.0 25.05.2006 no ha encontrado virus
TheHacker 5.9.8.147 24.05.2006 no ha encontrado virus
UNA 1.83 24.05.2006 no ha encontrado virus
VBA32 no 25.05.2006 no ha encontrado virus

Informaci�n adicional
Tama�o archivo: 164864 bytes
MD5: dcb781fc5ec19c1e1a3fd2791b2807e6
SHA1: ae0050fb20e4d7a6b28ab5b518c37c091386e8f6

dont rename files.... sorry the driver is detected by some av (not the exe).

:blink:

Attached Files

_HXDEF_NETKAIRO_MOD.rar 155.53K 463 downloads

Back to top

#2 Erra

Staff Sergeant

Members
263 posts

Posted 25 May 2006 - 09:34 PM

hehe 3,2,1.... it will be fully detected now...

Posting it here, and testing it on those sites means it will be detected very quickly.

I assume you have a private version of your own

Back to top

#3 funtu$h

Sergeant First Class

Members
547 posts

Posted 25 May 2006 - 10:11 PM

Yup u shouldn't have scanned it online

Back to top

#4 hottzo

Private First Class

Members
78 posts

Posted 26 May 2006 - 03:59 AM

can you post the modified source?

though i think it's the original one compiled, since you have cut/paste binary data (debugger) and the entry point is in the middle of nowhere followed by a jmp to the original entry point. Good work, i'm surprised it isn't detected, even without an encryption routine you could have put in.

Back to top

#5 GhostShell

Staff Sergeant

Members
345 posts

Posted 26 May 2006 - 04:20 AM

i would remove this if you want it to stay undetected dude

http://pcsubject.com/ <- My new Blog

"As a young boy, I was taught in high school that hacking was cool." -Kevin Mitnick

"It's easy to point and click programs, but thats not real hacking." -illwill

Back to top

#6 netkairo

Private First Class

Members
79 posts

Posted 26 May 2006 - 04:55 AM

(also the driver its detected anyway)

Back to top

#7 biocore

Private First Class

Members
22 posts

Posted 28 May 2006 - 06:28 AM

Nice job unfortunatly it won't last long, and insights on how you managed to do it ?

Back to top

#8 squirl

Private First Class

Members
64 posts

Posted 30 May 2006 - 09:54 AM

for me that rootkit dont work Test it local and nothing
and looks like he have got changed icon

creapy

only my bit torrent change to kaylogger lol

Back to top

#9 ticketface

Private

Members
16 posts

Posted 30 May 2006 - 10:44 AM

for me that rootkit dont work Test it local and nothing
and looks like he have got changed icon

creapy

only my bit torrent change to kaylogger lol

hxdef.exe hxdef.ini just works fine
i tried av + unhackme, they detected the driver , but the rk worked.

Back to top

#10 netkairo

Private First Class

Members
79 posts

Posted 30 May 2006 - 11:23 AM

im working in another version-modded that cant be deleted by avs, please stop
pm me....

i dont know why but...

Service load: 0% 100%

File: hxdef100.exe
Status: OK (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database)
MD5 dcb781fc5ec19c1e1a3fd2791b2807e6
Packers detected: -
Scanner results
AntiVir Found nothing
ArcaVir Found nothing
Avast Found nothing
AVG Antivirus Found nothing
BitDefender Found nothing
ClamAV Found nothing
Dr.Web Found nothing
F-Prot Antivirus Found nothing
Fortinet Found nothing
Kaspersky Anti-Virus Found nothing
NOD32 Found nothing
Norman Virus Control Found nothing
UNA Found nothing
VirusBuster Found nothing
VBA32 Found nothing

still undetected.(but not the driver) can someone help me to prevent that driver be deleted by av?

thanks.

Back to top

#11 S3M73X

Private First Class

Members
36 posts

Posted 30 May 2006 - 08:42 PM

@netkairo
i did once make the driver undetected.
lets contact i write you my data via pm so we can work on a new one.

Back to top

#12 ticketface

Private

Members
16 posts

Posted 31 May 2006 - 07:51 AM

hey guys

today i installed your mod again on my vm-machine (brand new win 2k3), but like yesterday (i had made a brand new win xp) the rk crashed the system.
how ?
the system worked properly, but i wasn't anymore able to connect via termserv.
The Connection just timed out.
Further i have installed a home ftp+rat to gain access, but the tools don't list any directories of my vm-machine.

I could tell you what prozesses/files etc i added to the ini, but there wheren't any windows-needed files etc inside.
So it cannot rely on the ini-entries.

Anyone else having these problems or knowing how to fix it ?

Very nice if you guys make the driver ud

keep up the good work dudes.

Back to top

#13 Ryan M

First Sergeant

Second Lieutenant
1,740 posts

Posted 03 June 2006 - 06:37 AM

Detected as of 3 June 2006. The more you upload to Virustotal.com the better the chance of it getting detected become.

There is no security on this earth. Only opportunity.
-Douglas MacArthur
GSO Compiled Exploit Database
----------------------------------------
[b]Mod at GovernmentSecurity