Skip to content

Latest commit

 

History

History
37 lines (27 loc) · 2.54 KB

3-Obfuscating-Trojan-SwayzCryptor.md

File metadata and controls

37 lines (27 loc) · 2.54 KB
Raw

Obfuscating a Trojan using SwayzCryptor

SwazCryptor a encrypter (or 'cypher') that allows users to encrypt the source code of their program.

A Crypter is a software used to hide viruses, keyloggers, or any RAT tool from antiviruses so that are not detected and deleted by AV's. It simply assings hidden values to each individual code within the source code. Thus, the source becomes hidden, making it difficult for the AV tools to scan it.

Objectives

  • How to crypt a Trojan and make it partially/ completely undetectable.

Requisites

  • Windows 10 virtual machine (Attacker).
  • Windows 7 or 8 virtual machine (Target).

Scanning Malicious File

  1. Log into Windows 10.
  2. Launch a web browser and enter the URL: https://antiscan.me
  3. Uplaod the malware file created in previous lab and start the scanner.

  • This site scan with various anti-virus programs in its database, and displays the scan result shown below:

    antiscan

  • Note the number of detection from AV's 21/26.

Crypt a Trojan file using SwayzCryptor

  1. Download the SwayzCryptor and launch the program.
    https://anonfile.com/JfI8EfI7ne/SwayzCryptor_zip

  2. Select the same malicious file that you have scanned:

    swayz

  3. Check the options Start up, Mutex and Disable UAC, then click Encrypt to start.

    swayz-2

  4. Scan the generated CryptedFile from SwayzCryptor on https://antiscan.me

    antiscan-reduced

    Note the file detected by very few anti-virus programs now, 12/26.

Test out the CryptedFile.exe

You can easily test if everything works using njRAT, share the malicious file with any Windows virtual machine, execute the file with njRAT opened on the Windows 10 machine. In case you're reading this tutorial randomly, on the previous lab is explained how to do this.