Executing shellcode in memory | Malware Development

[@C5pider]

cool video. just be aware that you have to handle the errors returned by win32 apis (VirtualAlloc, CreateThread, etc.). It is good progamming pratice to do so :P and you will figure out faster on why something doesnt work.

[@screeck]

Good point, I forgot about it. And thanks :)

[@Ale_Dev]

yooo spider from maldev accademyyy

[@danielrodriguez5960]

screeck: "I was a fool that night" LOL

[@sul3y]

The detection isn’t because of the encrypted Shellcode itself rather it was the use of AES encryption most of AVs signature these as malicious cause who would encrypt some BYTEs and call VirtualAlloc, CreateThread functions other than hackers

[@chathurangaonnet]

Thanks for the effort !!!

[@novianindy887]

is it detected by most AV now? Do you use any NTDLL.dll and is it not hooked by the AV ?

[@jamiedbighill7792]

u are seriously skilled

[@screeck]

Thanks, but I'm still a beginner, there is a long way ahead of me to master this things

[@jamiedbighill7792]

@@screeck same

[@Dzikk]

Siemson, masz dc do siebie?

[@aliena7407]

bro please post more vids about malware development thank you!

[@screeck]

Thanks, there will be a lot more but in february, I have tons of exams at uni right now 😂

[@aliena7407]

@@screeck okay bro goodluck

[@DutchNorthAtlanticAlliance]

Bro, can you cover Windows Registry hacking BRO

[@kamalchan9756]

you should xor windows apis

[@MalwareHunter_07]

And bro plz try and test your payloads on EDR as well :)

[@AidenPearce-i6d]

do the full course for maldev

[@aliena7407]

thanks for info!

[@TechnologicAll]

nice, but virustotal redistribute the results

[@koshane522]

Could you please tell me how can i learn about win32 api to write well?

[@screeck]

I'm no professional so I can't tell you what to do step-by-step.
My way of learning things is to do it "on the fly".
Think about something cool that you whould like to build (something that will use win32 api), and start researching.
Google, "how to do X using win32api" or something simmilar.
Learning by doing projects is never boring and very rewarding
Also Microsoft's documentation will always be your best friend (link in the description).
Good luck!

[@whnh]

nice vid

[@VenziL]

Well, no matter how much everyone asks not to upload to virustotal, they still upload it... why!?

[@screeck]

Hah, after this I won't upload my binaries to VT anymore, but I still need a place to test them tho. You know any good alternatives?

[@VenziL]

​@@screeckI would advise you to find out how to create sandboxes to test such files. In fact, the “Virus Total” is the same sandbox with antiviruses that sends reports about each file to the company. Of course, there are other services that may be analogues of this and “not send reports”, but I personally trust only what I can create myself.

[@VenziL]

​@@screeckI would suggest you learn how to create sandboxes to test such files. Essentially, “VT” is the same sandbox with antiviruses that sends reports to companies about each file.

[@VenziL]

I would suggest you learn how to create sandboxes to test such files. Essentially, “VT” is the same sandbox that sends reports to companies about each file.

[@MalwareHunter_07]

@@screeck use Cuckoo Sandbox

[@stanislavsmetanin1307]

Never upload to virustotal. It will be worked through and day later your work is scratched