Thread Rating:
  • 1 Vote(s) - 5 Average
  • 1
  • 2
  • 3
  • 4
  • 5
 
Reply 

How to make server/rat/virus fud without crypter

12-05-2012, 11:36 AM
Post: #1


Ive herd quite a few people moaning that they kind find crypters fud obviously u cant find them u have to pay for them nowadays so i spent abit of time looking for the best tutorial and here it is .......


Our FUDDING tool requirements and download links.



First of course an AV what I am going to be using is AVAST the free edition.

This link is hidden from you. If you want to see it you have to register on this board.

File splitter to split our servers to find out where the virus signature is to modify it.

This link is hidden from you. If you want to see it you have to register on this board.

Best hex editor I have found and its free of charge.

This link is hidden from you. If you want to see it you have to register on this board.


Now lets begin.

Now go grab the server you want to edit mine is going to be a Spyrex keylogger server you can use any keylogger server like neptune,ardamax,elite..etcetc.

Before we begin turn AV off.
You result may vary on AV your using.


Now place you server in a folder I recommend naming it A trust me on this. Now my server name is test.exe.

Okay now once you have placed the server in a file lets scan it.
And.......
OMG it got caught

[Image: 1.PNG]

Ok now where to start open The File Splitter and Calc.exe to split the file.
In
the file splitter browse to the server you want to split and choose
Custom size. Now it tells me that this server is exactly 53,495 bytes
and I want to split it into 4 pieces. So I go to Calc and divide it by 4
now place the number you got after dividing it and place it in the
splitter custom size box like I have at the bottom. Now click on Split.

[Image: 2.PNG]

Now you should get the files in the same directory like I have below.

[Image: 3.PNG]

Now scan each of them to figure out witch file we have to split again.

[Image: 02.PNG]

Now once you have figured it out make a new folder named the part
number that was detected now I got part 3 so I'm gonna make a new folder
named 3 .



Now I
hope you didn't close file splitter if so reopen it and browse to
test.exe.3 to split and change the output folder to 3 like I have in the
picture below. We are also going to split this file into 4 pieces again
so open up Calc and divide by 4.
I made a drawing on this if your confused

[Image: 4.PNG]

Now you should have this inside folder named 3.

[Image: 5.PNG]

Now
scan each file again to figure out witch file we need to split but also
be aware of how small the file is getting. Once you figure out witch
file needs splitting make a new folder with the parts name. I got part
test.exe.3.3 so I am going to make a new folder and name it 3.

[Image: 6.PNG]

Now
once you made new folder named 3 open up file splitter and browse to
the file that got detected mine was test.exe.3.3 and pick the output
directory to the folder we just made witch was the folder named 3.

[Image: 7.PNG]

Now
browse to the new folder and scan the new files we split. As you can
see test.exe.3.3.4 was detected so I'm gonna make a new folder and name
it 4.

[Image: 8.PNG]

Now in file splitter pick the file that got detected witch was test.exe.3.3.4 and choose the new folder we made named 4.

[Image: 9.PNG]

Now lets scan the new files and see witch got detected ocne we find it open it up with the HEX editor and see if its still to big to figure out what we need to change.

[Image: 10.PNG]

Ok so it's test.3.3.4.1 that we need to edit do open it up with your favorite hex editor or use the one I provided earlier. Once you open it it will look something like this.

This link is hidden from you. If you want to see it you have to register on this board.

Now
the virus signature is in here don't get scared its not that hard now
my method of figuring it is looking for something that stands out or
guesssing. All you really have to do is change a letter from capital to a
lower case one now what worked for me was changing D to a lower case
from the word DLLHOOKSTRUCT.

[Image: 12.PNG]

Congratz now its FUD now all you need to do it compile it and scan it one more time and run it to test.

Now compiling I will show you one example and you can figure out the rest by your own.



Now you see the splitter icon inside your folder click on it and it will recompile the file.

[Image: 14.PNG]

Now

once you made that file copy it and go back one directory and past it
then it will ask you to replace it click yes and keep doing this till
you go back to first directory. And your done.

[Image: 15.PNG]

Credits to dev for this tutorial...

Note this can also make ur server corrupt using this technique but its only happened to me once this tecnique will save u money with crypters Wink
Reply
12-05-2012, 08:48 PM
Post: #2


Looks legitimate. Thanks for the share!

This link is hidden from you. If you want to see it you have to register on this board.

Reply
12-06-2012, 07:27 AM
Post: #3


Good tutorial. Thanks for the share.
However I still prefer to write my own crypter. Sometimes you can corrupt a file, but not realize immediately.
Reply
12-06-2012, 07:33 AM
Post: #4


Copy pasta hardcore 2012 @Hacksociety.net!

nyancat
Nyan Nyan

Reply
12-08-2012, 07:01 PM
Post: #5


Nice tut kris, thanks for share..

[Image: nordaciabanner2013.jpg]
ßè ƜāƦƝƎƊ / 被警告 / זהר / بايد هشدار داد / ßè ƜāƦƝƎƊ ƉǟŸ Ǯ ħĩĝĦŤ ƤāŢĥ řō èńĮıĝħĩɱɘɴȾ
[Image: 2012kb.jpg]

Reply
01-08-2013, 10:39 AM
Post: #6
NICE ONE BRO i will give it a try on adamax
Reply
01-24-2013, 11:38 AM
Post: #7


this is quite fucking interesting if it works considering i have had no luck with code dom or runpe no matter what beacuse of the av's detecting a MSIL crypter or packer even after assembly info is different a source code in completly obfuscated i mean fuck i even obfuscated my runpe dll imports and all that

d3ath is unstoppable hackers aren't lol

Reply
01-27-2013, 02:26 PM
Post: #8
thanks bro.. nice tutorial..
was looking for this and 1 with file extension n 1 wtih binder
Reply
01-29-2013, 04:05 AM
Post: #9
I'm not sure if that works of literally everything, there are different methods . . .
Reply
01-29-2013, 12:56 PM
Post: #10
Ooooo very nice! I was searching something about this! Thanks! Smile
Reply

Reply 


Thread Options


User(s) browsing this thread: 1 Guest(s)
Proudly run by MyBB, © 2002-2014 MyBB Group