26 replies to this topic

[vnet576]

This is the way I've been binding my files, and since I saw eyeless's thread I decided to make a tutorial for it. This is completely undetectable by Kaspersky av and I assume by other lesser AV such as norton, mcafee, etc. I included my binder source, the source for another prog, and my tutorial for this. I also included a bound file called File_Binder.exe. That file contains two very dangerous worms. That is to see if you're av detects it. If it does post what the two worms are and what AV you used. I decided to post the same tutorial on codelinx and here. For specific programming questions about this binder go there. Enjoy:

Undetected by Kaspersky:
http://www.kaspersky...teviruschk.html

Current object: File_Binder.exe
File_Binder.exe Ok

Edit:
Later I plan on adding an encryption algorithm to encrypt the hexdumped data..making it even more secure.

Attached Files

•  Binder.zip   226.07K   633 downloads

Edited by vnet576, 29 February 2004 - 12:33 PM.

[fre4k]

Many Thx for It! I will test

[320X]

thanks vnet576 for the post

[invisible-boy]

thx @ lot
----
but my AV detect it,
first Bluster ,second W32.Sobig.A@mm "%systemroot%\newfile2.exe"
it detect and not undetect

[vnet576]

of course it would...once the files are extracted and ran. I'm talking about the file File_Binder.exe which u would send to the victim.

BTW...I hope you're av detected them before those 2 worms had a chance to execute.

Edited by vnet576, 29 February 2004 - 02:51 PM.

[fyle]

grisoft AVG detected one as lovesan.A but didn't find anything in the other

[paskaluis]

thx for the binder File i gonna check it out

[meinaeiner]

@vnet576

antivir PE reports sorbig.a in file_binder.exe.
nod32 finds nothing.

thx

[linuxwolf]

This looks like a very nice and original piece of work, it's rare, very.
Congratulations vnet, you've got my attention.

[Eyeless]

THANK YOU!

[d0whc3r]

Thx you!
very usefull, but the trojan is detected when the new file is created hehe

[vnet576]

Thx you!
very usefull, but the trojan is detected when the new file is created hehe

Yes I've noticed that..but that is the case with most binders...Once the output file is placed on the desktop it becomes fair game to the AV. I'm open to ideas for bypassing that. I'm currently thinking about injecting the two output trojans directly into memory.

[DaClueless]

Thanks vnet576

I will look it over, and decode your ASM and post it, if that is ok?

If not, just make a reply and I will not post the ASM version of your stuff