56 replies to this topic

[Ryan M]

Got board, small delphi backdoor, modded, packed, and crypted. Just wondering waiting to see how long it takes to get detected -- Knock yourselve's out.

Info: Listens on port 447, returns shell upon connection.

A-Squared  Found nothing 
AntiVir  Found nothing   
ArcaVir  Found nothing 
Avast  Found nothing 
AVG Antivirus  Found nothing 
BitDefender  Found nothing 
ClamAV  Found nothing 
CPsecure  Found nothing 
Dr.Web  Found nothing 
F-Prot Antivirus  Found nothing 
F-Secure Anti-Virus  Found nothing 
Fortinet  Found nothing 
Kaspersky Anti-Virus  Found nothing 
NOD32  Found nothing 
Norman Virus Control  Found nothing 
Panda Antivirus  Found nothing 
Rising Antivirus  Found nothing 
Sophos Antivirus  Found nothing 
VirusBuster  Found nothing 
VBA32  Found nothing

[ConfigSys]

link?

[AfroSamurai]

May be he jst forgot to add the link for dwnloads but soon he'll

[LoG]

it is so undetectable that even gov can't found it to share!

[Ryan M]

Totally forgot, it was late

Attached Files

•  Shell.rar   25.43K   1117 downloads

[Edu]

hmmm nice one Ryan.

so far 9 downloads. I bet there are antivirus vendors here that will send the file to the company, so probably wont take long to be detected.

[Ryan M]

Yeah, i'm not to worried about it. My first public UD Project. Used a few new methods I've never tried. I'm surprised there are only 9 downloads TBH. I'm dying for the kiddies to go nuts ;p

Still good though

Antivirus Version Last Update Result 
AhnLab-V3 2007.10.27.0 2007.10.26 - 
AntiVir 7.6.0.30 2007.10.26 - 
Authentium 4.93.8 2007.10.26 - 
Avast 4.7.1074.0 2007.10.26 - 
AVG 7.5.0.503 2007.10.26 - 
BitDefender 7.2 2007.10.27 - 
CAT-QuickHeal 9.00 2007.10.26 - 
ClamAV 0.91.2 2007.10.27 - 
DrWeb 4.44.0.09170 2007.10.26 - 
eSafe 7.0.15.0 2007.10.22 - 
eTrust-Vet 31.2.5244 2007.10.26 - 
Ewido 4.0 2007.10.26 - 
FileAdvisor 1 2007.10.27 - 
Fortinet 3.11.0.0 2007.10.19 - 
F-Prot 4.3.2.48 2007.10.26 - 
F-Secure 6.70.13030.0 2007.10.26 - 
Ikarus T3.1.1.12 2007.10.27 -
Kaspersky 7.0.0.125 2007.10.27 - 
McAfee 5150 2007.10.26 - 
Microsoft 1.2908 2007.10.27 - 
NOD32v2 2620 2007.10.27 - 
Norman 5.80.02 2007.10.26 - 
Panda 9.0.0.4 2007.10.27 - 
Prevx1 V2 2007.10.27 - 
Rising 19.46.42.00 2007.10.26 - 
Sophos 4.22.0 2007.10.27 - 
Sunbelt 2.2.907.0 2007.10.27 - 
Symantec 10 2007.10.27 - 
TheHacker 6.2.9.107 2007.10.25 - 
VBA32 3.12.2.4 2007.10.26 - 
VirusBuster 4.3.26:9 2007.10.26 - 
Webwasher-Gateway 6.6.1 2007.10.27 -

[EviL]

Gonna test your work Ryan

Any chance to see the source in the future?

[Candypapa]

it will be nice to see the source

was checked it and it seems to unpacking some other file named

peloader.exe and putting it in system32 folder and lunching it

and it was made in vb.

[Ryan M]

Ummm...no actually It was made in Delphi. And the source code will not become public, due to the private version of this program (passwords, file transfers etc...) as well as a different service name.

[AfroSamurai]

Ummm...no actually It was made in Delphi. And the source code will not become public, due to the private version of this program (passwords, file transfers etc...) as well as a different service name.

So how do you really use this backdoor mate ?
wht kind of fetures does this version have ?

Thanks

[EviL]

idd can u give a list of feature? i saw it only install a PELoader.exe in system32....

[AfroSamurai]

so wht is your guess Evil ?
And how do i uninstall this ?

[snitch]

tested on 2 boxes, worked fine, too bad there's no pass auth though, but nice work anyway

[as0l0]

hmmm nice one Ryan.

so far 9 downloads. I bet there are antivirus vendors here that will send the file to the company, so probably wont take long to be detected.

which shows why these things should be named as undetected rather than undetectable.

anyway, i couldn't do what you've done, so not bagging you at all.