bypassing windows defender | Malware development

[@rabih.khaddour3058]

Thank you for your effort
an adequate and professional explanation of the checking and skipping process. How lucky I was to visit your channel.

[@Hicham_ElAaouad]

thanks rabih

[@viniciusgamerS2]

ME TOO

[@Chinmoy-bf6cz]

When you are trying to test malware please turn off automatic sample submission,and cloud deliver protection...if you turn on this the malware no longer stealth..it will be detected by defender

[@Hicham_ElAaouad]

ok chef

[@emeraldArmy4267]

I was looking at this too lol

[@idkk403]

More than excellent!!! Very informative and great work. Hard work can be seen here.

[@Hicham_ElAaouad]

thanks 🙏🙏🙏🙏🙏🙏🙏

[@xendo2d987]

really good video, informative and interesting! keep up the good work!

[@ismailajizou]

First comment, such a good video. Keep up the good work 💯💪

[@Hicham_ElAaouad]

my bro

[@adamchalabi3654]

great vedio!!!! please never give up and always keep going your vedios are great its like dimond in my eye

[@Hicham_ElAaouad]

🙏🙏🙏🙏🙏🙏🙏🙏🙏

[@mohamedboutaleb3526]

Excellent material presented in an easy-to-understand manner.
Keep it up brother.

[@Hicham_ElAaouad]

thanks brother 🙏

[@khaelkugler]

Holy crap this was such a fantastic video. You're very underrated, keep at it!!

[@Hicham_ElAaouad]

thanks bro

[@abdelghafourbouhdyd5680]

Good stuff . I really enjoyed watching and learning thank you !

[@Hicham_ElAaouad]

thanks bro

[@nassimamrane5052]

Salam 3aleykoum god bless you this is intresting video im french and its so hard to understant english for me while i speak well.. weird but if i understood this is cuz you are good educator

[@Hicham_ElAaouad]

Merci BOSS

[@soumyanilbiswas_reveng007]

Hey man great video ❤ , waiting for ur edr evasion course:)

[@Hicham_ElAaouad]

thanks bro, it's gonna be released soon

[@Toowan0x1]

Many thanks for sharing, keep up the excellent work ;)

[@Hicham_ElAaouad]

thanks bro

[@francisakwasi8513]

You are the best I used you method to my python script and it works perfectly well

[@Hicham_ElAaouad]

nice bro, glad that it works for u

[@dscyberdefense]

could you share your python version? Maybe github link?

[@mikaay4269]

That isn't signature detection. Signature detection takes a sha hash of the entire file and compares it against a database of known malicious hashes. Only looking at strings is a bad and unreliable way to detect malware.

[@HichamElAaouad-s2u]

hey thanks for watching, that was just a simplified way to explain things at the beginning.

[@mustaphaaitichou1519]

Thank you for shariing and your effort Keep up the good work 💯💪

[@Hicham_ElAaouad]

thanks bro 🙏

[@mojed6666]

Really good Video hope that more is coming

[@CodeX-0x00]

You are a creative man.. good work ❤

[@Hicham_ElAaouad]

Thank you 🙌

[@BugandaLwazi-p8p]

Thank you bro for this educative tuitorial.

[@Hicham_ElAaouad]

Thank you for your kind words, it means a lot to me!

[@imensaad2350]

keep the good work Hicham

[@Hicham_ElAaouad]

thanks

[@هلتعلم-م9ر5م]

Thank you for your wonderful explanation

[@Hicham_ElAaouad]

Glad it was helpful!

[@neotokyo98]

hope more such vedios in future comes

[@Hicham_ElAaouad]

thanks for watching, more is coming

[@patricklechner190]

Is Defender for endpoint different? With Tampsr Protection?

[@novianindy887]

between C or C++ which one is better for mal dev?
and if you obfuscate the winApi functions, will it even matter since the AV/defender will hook the winApi calls so if it's called the AV will know.

[@HichamElAaouad-s2u]

videos about advanced evasion techniques are coming soon

[@novianindy887]

@@HichamElAaouad-s2u so is it C or C++ do you prefer?

[@ムワ-d7n]

but how can we bypass false positives check like wacatac in windows def ?

[@viduraranathunga6000]

where is that course???

[@Hicham_ElAaouad]

working on it

[@elzaghory4212]

How to fix cannot convert 'const wchar_t*' to 'LPCSTR' {aka 'const char*} ?.

[@Abdul988-u8r]

Hi, i am trying to run the c++ code but i am unable to run it , it gives me the following error:
::sockaddr_in has' has incomplete type and cannot be defined
How can I fix this? Am i missing a step or something? I am not very familiar wih C++

[@palette454]

Really good job, but what about the fact that the payload is executed through Visual Studio, which is a trusted process? In a real scenario, the victim would get the process from, let's say, his navigator, right? (which will already say that this is probably a virus cuz the source is unknown), then Windows will probably pop up the Windows smart-screen since the source of the exe is also not known. So if the victim still trust the payload from these two warnings, will the payload still bypass WD?

[@Hicham_ElAaouad]

thank you for watching, yes it still bypass it, there are others scenarios to put the file on the machine not just the browser. and the video idea to learn more about winapi, how av works

[@albertkaminski9960]

you would not put it in a .exe you would inject it into a running process so the the malware executes in memory and never touches disk.

[@zakariaouakrim3907]

Great video !! keep it up !!!

[@Hicham_ElAaouad]

thanks bro

[@eshan7968]

How did you convert the IPv4 to those offset values?

[@Hicham_ElAaouad]

using the obfuscation function

[@TheTubejunky]

What about loading custom apps after gaining shell without that new prog being detected by the user. I guess renaming it as a system file.

[@Hicham_ElAaouad]

i didn't get the technique bro, if you can explain

[@Jerometk]

​@@Hicham_ElAaouadhe means once you own the machine how to install other applications wothout raising alerts or being blocked

[@IND_Hunter]

i have win 10 with latest update but my system cannot detect simple socket revershell program [without any obuscation] as malicious and virus & threat protection setting in turn on [exception automatic sample submission]

[@Hicham_ElAaouad]

thanks for watching bro, it's weird, but this obfuscated shell is working on other EDRs (not just win 10), i didn't want to show it since there is another video soon.

[@Jerometk]

Can you do one about bypassing an antivirus

[@Hicham_ElAaouad]

why not inshalah

[@mohamedelhawie5546]

معلم 👍🌷

[@AhmedDridi-fz4sw]

Good job 👏♥️

[@Hicham_ElAaouad]

Thank you 😁

[@tleg333]

Wow very good
Your course ready or not

[@Hicham_ElAaouad]

Very soon

[@hackerBoss-z5z]

Hello brother how can I contact u

[@yipo1]

khdma n9iya, nadii

[@Hicham_ElAaouad]

lyhfdek akhay

[@menreikichan8291]

Does this still work?

[@Hicham_ElAaouad]

yes bro

[@TheTubejunky]

Noice

[@BigG9982]

selamu aleykum akhi, can you make a video about crypters and shellcode encryption shellcode loader and stuff like this this would be good because i cant find much about it and i guess many guys like me need help in this i stuck on this for so long
reverse shells with netcat its cool and nice to evade avs but its not real shit you know what i mean by that ?
shellcode encryption and run it in memory to evade avs or make a simple shellcode encryptor to evade avs or a crypter with a stub and stuff like this can you help by this ? have a great day

[@Hicham_ElAaouad]

thanks for watching bro, i appreciate it, i will do my best inshalah

[@menreikichan8291]

@@Hicham_ElAaouadHi does it still work? Pls

[@JuanBotes]

\o/ awesome

[@Hicham_ElAaouad]

thanks bro

[@vivaw4929]

it's working broo😇

[@MR.HOUSSAM-G2G]

واش نتا مغريبي 😅

[@Hicham_ElAaouad]

wayih akhay 🙂

[@4li1y3vsul3ym4n]

Did not get the idea of changing IP to offset ? i mean tried my own connection was not successful

[@MaliAhme]

bro put us code here

[@Hicham_ElAaouad]

it's in the description down the video

[@MaliAhme]

@@Hicham_ElAaouad i need file malware ready

[@MaliAhme]

@@Hicham_ElAaouad pls bro

[@Sam_Fedro]

la la naadi a khay
englais n9iya

[@Helloworldred]

dont trust this guy's edr course he knows what hes doing but he should relearn c++