Sunt multe modalitati foarte grele, dar una dintre cele mai simple e sa ai virusul necomprimat, sa il modifici cu Morphine (incearca mai multe combinatii), dupa care sa il comprimi cu un UPX foarte puternic. That's all folks !
am una mai usoara...daca tot esti programator si ai un antivirus updatat la zi....compilezi virusul facut de tine pana nu-l detecteaza antivirusu ... MuCH EASIER!
#5
Inside Elite Member Din: ..:: Angels City ::..
Postari: 1351
si daca nus programator. .ma invetzi u sa..programez unu ?;- ???:d :cenzurat:
si daca nus programator. .ma invetzi u sa..programez unu ?;- ???:d :cenzurat:
Ce-i atat de greu...vointa si rabdare sa ai...incearca pe visual basic 6 ca ala ii super usor si "user friendly"... iar tutoriale gasesti pe net cu caru...scrii doar ce te interesaza...sau iei de aici >>> www.google.ro :cenzurat:
#10
Inside Elite Member Din: ..:: Angels City ::..
Postari: 1351
Morphine as a part of The Hacker Defender Project (a simple morphing program with output directly to X or GIFs). Morphine is very unique application for PE files encryption. Unlike other PE encryptors and compressors Morphine includes own PE loader which enables it to put whole source image to the .text section of new PE file. This one is very powerful because you can compress source file with your favourite compressor like UPX and then encrypt its output with Morphine. Another powerful thing here is polymorphic engine which always creates absolutely different decryptor for the new PE file. This mean if your favourite trojan horse is detected by an antivirus you can encrypt it with Morphine. You will not get the virus alert again. What's more, Morphine allows you to encrypt one file several times! But be sure you're using -b option (see usage) when doing this. Unlike others Morphine enlarges your executable by not more than 5kb (this is not true for morphined DLLs without using -d option, see below)! Morphine supports most of PE files and many of other PE encryptor/packers. Also one of the greatest things here is that it is an open source project. In these days antivirus companies sniff around our site waiting for new version of morphine to add new decoder into their databases. But you can simply make your own undetectable version. Because new PE file has random loader it is possible the loading will take more time than you want to (especially when encrypting bigger files). If this occurs simply delete the long time loading PE file and try to build it again. And be careful with morphined DLLs. This can really slow down final execution. Whole Morphine code is compatible with Delphi 6 and 7 compiler. Morphined files can be executed on Windows with NT kernel only. Usage -----
Usage: morphine.exe [-q] [-d] [-b:ImageBase] [-o:OutputFile] InputFile -q be quiet (no console output) -d for dynamic DLLs only -i save resource icon and XP manifest -a save overlay data from the end of original file -b:ImageBase specify image base in hexadecimal string (it is rounded up to next 00010000 multiple) -o:OutputFile specify file for output (InputFile will be rewritten if no OutputFile given)
Examples: 1) morphine.exe -q c:winntsystem32cmd.exe rewrite cmd.exe in system directory and write no info
2) morphine.exe -b:1F000000 -o:newcmd.exe c:winntsystem32cmd.exe create new file called newcmd.exe based on cmd.exe in system dir set its image base to 0x1F000000 and display info about processing
3) morphine.exe -d static.dll rewrite static.dll which is loaded only dynamically
4) morphine.exe -i -o:cmdico.exe c:winntsystem32cmd.exe create new file called cmdico.exe based on cmd.exe in system dir save its icon and or XP manifest in resource section
5) morphine.exe -i -a srv.exe rewrite srv.exe, save its icon, XP manifest and overlay data.
_______________________________________
#12
Shocker Super Moderator Din: localhost
Postari: 2084
dark_hacker_3k a scris:
Sunt multe modalitati foarte grele, dar una dintre cele mai simple e sa ai virusul necomprimat, sa il modifici cu Morphine (incearca mai multe combinatii), dupa care sa il comprimi cu un UPX foarte puternic. That's all folks !
"UPX foarte puternic?" Ce intelegi tu prin asta?
Sad_Dreamer a scris:
nu tzine...asta stiau si aia de la antivirusi...aia care lucreaza acolo si nu tine
Intr-adevar, si antivirusii stiu algoritmul de criptare de la foarte multe packere, il unpack-uieste si vede cum sta treaba
3Nigma a scris:
am una mai usoara...daca tot esti programator si ai un antivirus updatat la zi....compilezi virusul facut de tine pana nu-l detecteaza antivirusu ... MuCH EASIER!
Mai... daca faci tu virusul nu il detecteaza nimeni.
Inside a scris:
si daca nus programator. .ma invetzi u sa..programez unu ?;- ???:d :cenzurat:
Chair crezi ca prin cateva cuvinte te invata sa programezi?
Cea mai usoara metoda e sa faci tu un packer (nu cine stie ce kkt) care sa inlocuiasca toti bytes-ii dintr-un executabil cu altceva, sau sa faca un XOR. De exemplu 1 sa il schimbe cu 53, blabla, sau pur si simplu adaugi 1 la fiecare byte (numar cu valori curpinse intre 0-255), si faci la inceputul programului o secventa care reface totul cum era inainte de pack-uire (Totul se face printr-un singur LOOP cu cateva linii de cod) In ASM ar arata cam asa:
Code:
PUSHAD
MOV EDX, xxx (xxx = lungimea codului)
@blabla: (label pentru revenire de la un JMP)
MOV EAX, ep (EP=Entry Point, adresa de pornire a executiei programului)
ADD EAX, EDX
MOV EBX, [DS:EAX]
XOR EBX, 5
MOV [DS:EAX], EBX
DEC EDX
TEST EDX
LOOPNZ @blabla
POPAD
din lista d programe pt k linkul nu merge......Help me pls
#14
TE4L
Vizitator
[virus ptr windows] sau altfel. creezi virusul pe un calc fara antivirus. il testezi, sa vezi daca merge. si urmezi un plan simplu. faci un alt virus care nu face mai nimic decat creeaza niste .bat cu comenzi care sa stearga fisiere importatante ale antiviruselor si un .bat care sa le apeleze pe toate succesiv. si incluzi ca resursa virusul, daca vrei encriptat cu o anumita cheie si sub un anumit algoritm si il salvezi undeva.
dupa ce ai sters fisierele antivirusului faci ca virusul sa fie rulat a doua uara si salvezi virusul initial undeva si il rulezi. simplu nu?
stiu ca e complex dar e mai bun pentru cei care sunt la inceput cu chestia asta.
merge sa stii. am reusit momentan sa transform o imagine monocromatica .bmp intr`un sir de numere de la -128 pana la 128 si sa le implementez un array constant cu ele.
Sunt multe modalitati foarte grele, dar una dintre cele mai simple e sa ai virusul necomprimat, sa il modifici cu Morphine (incearca mai multe combinatii), dupa care sa il comprimi cu un UPX foarte puternic. That's all folks !
"UPX foarte puternic?" Ce intelegi tu prin asta?
shocker mi-a facut demonstratie live cum sa decriptezi o aplicatie criptata cu UPX ...si nu folosing tot UPX ci un debugger ( OLLYDBG ) Shocky r0x
_______________________________________ In caz ca nu sti...Getting Laid <> Getting r00t
acesta este primul meu post pe acest forum..so here it goes:
--=[ How to: Create unique strains of Trojans ]=--
Okay, it seems that many people still don't know how to create a new strain of their favourite public Trojan that will pass anti-virus approval. So here's a step by step cus its something that everyone should really know.
You will need ... your Trojan A hex editor A file splitter would be handy too : )
Create a directory and place your Trojan server.exe in it Run AV over the directory and it will spot the .exe as a virus
Use the file splitter to cut your exe into separate 1mb sections Run AV over the directory and it will spot one of the files as a virus
delete the others.
keep splitting the (now 1mb) partial.exe into smaller sections till you get it real small and still triggering the antivirus.
when its about 24 bytes start deleting the last byte and running AV ... then deleting the next last byte and running AV ... till AV fails to recognise it
... 93 05 B4 4A CD 21 <- Spotted as Trojan ... 93 05 B4 4A CD <- Spotted as Trojan ... 93 05 B4 4A <- NOT spotted as Trojan
replace the last byte
... 93 05 B4 4A CD
Now lets trim the starting bytes the same way ... one at a time till no longer recognised as a Trojan
22 23 51 8C DB 8E C3 ... <- Spotted as Trojan 23 51 8C DB 8E C3 ... <- Spotted as Trojan 51 8C DB 8E C3 ... <- Spotted as Trojan 8C DB 8E C3 <- NOT Spotted as Trojan
replace the last byte you removed
51 8C DB 8E C3 ... 93 05 B4 4A CD
now you should have the smallest number of bytes (maybe about 12) that the AV program will recognise as being the Trojan. Congratulations, you just found the viral signature
now ... lets find where that sequence of bytes occurs in the original .exe .... lets say at offset 0D98:0348
load your server.exe into Microsoft's 'debug' program with the DOS command 'debug server.exe' and go to that offset, then press U to disassemble the bytes.
51 8 0D98:0348 C DB 8E C3 8B 1E 93 05 B4 4A CD 51 PUSH CX 0D98:0349 8CDB MOV BX,DS 0D98:034B 8EC3 MOV ES,BX 0D98:034D 8B1E9305 MOV BX,[0593] 0D98:0351 B44A MOV AH,4A 0D98:0353 CD21 INT 21
Look at the instructions ... PUSH CX pushes the CX register onto the stack, and the following instruction MOV BX,DS doesn't alter CX -or- the stack ... it is fairly safe to assume we can swap these two instructions and hopefully it wont make a difference to the execution of the program ... so lets do that
so that it becomes '8C DB 51 8E C3' 0D98:0348 8CDB MOV BX,DS 0D98:034A 51 PUSH CX 0D98:034B 8EC3 MOV ES,BX
And save our new server.exe
Since we have switched a few bytes in the signature it will no longer register as a Trojan on our AV. Test it to make sure it still works as expected - it should if you are careful about which two instructions you switch : )
also remember that only one byte of the signature needs to change ... so don't worry if one of the instructions you chose is partially or even completely outside of the signature bytes - as long as it results in some change within the signature : )
NOTES: Not all antivirus programs use the same set of bytes for a signature - so check your new file against other popular AV programs too, and repeat the process if required, till ALL common AV programs fail to report the file : )
You may also need to do the same with any supporting .DLL's that the server installs on the remote, as these normally have telltale signatures too.
Once you have a new version DONT post it ... if it is widely distributed it will eventually find its way onto the AV vendors lists as a 'new strain' - treat this as a PERSONAL version, and it will last you long into the future : )
ba da pentru ce imi trebuie mie sa virusez calculatorul cuiva? Adik la ce imi foloseste? ce as putea sa aflu sau sa obtin de la el in afara de distractia ca i-=am distrus aluia sistemul?
Cum sa faci un virus nedetectabil - modalitate usoara – poza de Jedy_08, in Virus/Trojan · 3.5KB
_______________________________________ Sunt incepator.....adik vreau sa invat
#24
tw8 Elite Member Din: Drobeta Turnu Severin
Postari: 1087
Jedy_08 a scris:
ba da pentru ce imi trebuie mie sa virusez calculatorul cuiva? Adik la ce imi foloseste? ce as putea sa aflu sau sa obtin de la el in afara de distractia ca i-=am distrus aluia sistemul?
U ai vazut in ce data a fost ultimu' post :nebun:??? ontopic: Printr-un trojan poti sa controlezi calculatoru' persoanei careia ii trimitzi sv si poti afla tot ce face :-)......deci e interesant :P
( pacat
... MuCH EASIER!
:cenzurat::cenzurat::cenzurat:
