AVIator Crypter

[Cracker39931]

AV|Ator is a backdoor generator utility, which uses cryptographic and injection techniques in order to bypass AV detection. More specifically:

• It uses AES encryption in order to encrypt a given shellcode
• Generates an executable file which contains the encrypted payload
• The shellcode is decrypted and injected to the target system using various injection techniques

1. Portable executable injection which involves writing malicious code directly into the process (without a file on disk) then invoking execution with either additional code or by creating a remote thread. The displacement of the injected code introduces the additional requirement for functionality to remap memory references. Variations of this method such as reflective DLL injection (writing a self-mapping DLL into a process) and memory module (map DLL when writing into process) overcome the address relocation issue.
2. Thread execution hijacking which involves injecting malicious code or the path to a DLL into a thread of a process. Similar to Process Hollowing, the thread must first be suspended.

RTLO option​

In simple words, spoof an executable file to look like having an "innocent" extention like 'pdf', 'txt' etc. E.g. the file "testcod.exe" will be interpreted as "tesexe.doc"
Beware of the fact that some AVs alert the spoof by its own as a malware.

Set custom icon​

I guess you all know what it is

Bypassing Kaspersky AV on a Win 10 x64 host (TEST CASE)​

Getting a shell in a windows 10 machine running fully updated kaspersky AV

You must register or login to view this content.