Aug 23, 2016

All About Crypter

What is a Crypter?
A Crypter is a software encryption which encrypts your viruses, keyloggers, RATS or any other hacking tool from becoming detected by Antiviruses. A Crypter makes Antiviruses pretty much useless. This is because when encrypting any malware tool, the Crypter uses various encryption methods to bypass Antiviruses from analysing the output.

What does Scantime and Runtime mean?
Scantime is a method used to bypass Antiviruses from analysing your encrypted files, while real time protection is enabled.Runtime is used to bypass Antiviruses when the encrypted file is executed. The Runtime method then decrypts the encryption in the memory. Generally all Crypters use the Scantime and Runtime method.

What is the Stub?
The Stub is packed with junk or undetected code to help your encrypted file stay fully undetected for some time or maybe even weeks. When the stub eventually becomes detected, the file becomes detected by antiviruses when executed on the machine.

What is EOF?
EOF is a short word for End of File. Some applications such as Bifrost and Cybergate require the End of file data to be Crypted without getting corrupted. If Crypters dont use this important functionality then the file output becomes corrupted.

What is the Client?
The client is the application and interface where you browse and encrypt your data.

What are Dependencies?
.NET Crypters uses the .NET framework functionality, to make the Crypter function. Therefore .NET Crypters requires the .NET 2.0 for the encrypted data to execute. Some Crypters uses no dependencies and this means the victim machine doesnt require .NET in order for the file to work.

What is a file binder?
A file binder is used to bind executable file to other files such as .PDF, .DOC, .GIF and etc.

What is a Downloader?
A downloader downloads and executes the file which was uploaded on the link, on the first run. A downloader reduces the size of the file.

What is the Startup option?
When Crypting files it is important to select the Startup option. When the file gets executed on the machine and if the Startup option is not checked, then this means when the machine is restarted you will lose the client.

What is Pump File?
A file pumper increases and adds bytes to the Crypter file to increase the output size.

What does Melt file do?
When the Crypted file is executed, the file itself melts and deletes itself from the machine.

What does Hide file do?
When the Crypted file is executed it stays in the same place, but it changes its view mode from visible to hidden.

What is Delay Execution?
Delay execution typically delays the execution of the decryption process, by some seconds. This can also become useful when bypassing popular antiviruses on runtime. This can also make the Crypted file look less suspicious.

What are Antis used for?
Antis are used to bypass certain applications such as Anti-Sandboxie, Anti VM-Ware and etc. For example when the Crypted file is executed in Sandboxie, the Crypted file will refuse to execute in Sandboxie because the Anti-Sandboxie option was checked before Crypted.

What is a Botkiller?
A Botkiller is uses to kill other Crypted files which are installed on the machine.

What is Persistence?
The persistence option makes the Crypted file harder from becoming killed by Botkillers.

What is a USG?
A USG is a generator that produces unique stubs. Each Stub is different and  used to crypt the stated file. The Crypter Fudness does not last so long so therefore the USG helps the Crypter by giving out FUD outputs.