Crypters - Some questions

[0x00pf (pico)]

@oiashdhf

if the contents are encrypted, how antivirus are able to catch them?

Hi @oiashdhf

Actually there is a part that is not encrypted, otherwise the program cannot run. This is usually named stub and AV can either just add a signature that matches that stub as well as analyse the use of certain system calls that are required in order to be able to decrypt and run the .text segment. Furthermore, some techniques to run the decrypted code (to give control back to the original program) are commonly used by virus and therefore are well-known to AV SW.

You can take a look to:

Programming for Wanabes XIII. Crypters part I

This is the first instalment to dive you deep into the awesome world of crypters. You will learn everything about these little guys which are a usual component of different types of malware, including the RATs that we are discussing right now. Technically, crypters, in their traditional form, are closer related to virus, than to any other malware, in the sense that they require in deep knowledge of the binary format of the target system (ELF, PE,…), but this looks like a good time to start digg…

Programming for Wannabes XIV. Crypters Part II

In the previous instalment we manage to find the relevant parts of the binary to crypt and actually crypt them. Now we need to inject our stub code and modify the binary to execute it before anything else. This gonna be fun. A Test Stub Instead of going with the full stub I will first introduce a very simple one so we can focus on the code injection concept. Why?. Well, this is how I actually did it. The real stuff is a relatively complex program that will have its own bugs, so we better use a…

Progamming for Wannabes XV. Crypters Part III

Finally we are going to get our crypter complete and operational. We have already covered the main technical areas involving ohow ton crypt binaries and now we just need to commit. We already have a complete crypter able to crypt the relevant parts of the code and inject our stub using different techniques. We are only missing the final version of our stub. In this last instalment we are going to put together all the elements to get our stub complete. What does that stub do again? Before cont…

To check the basics: What is that stub about? or what syscalls are required and why? These posts are GNU/Linux oriented but the concepts are the same for all OSes… You just have to use different syscalls and deal with different file formats.

Hope this helps