Hey readers, pardon me for writing this so late. I think many of you have
forgotten about this post.Actually I had many projects to be done. And therefore
didn’t get enough time to browse internet. You wanted a binding and crypting tut
but I thought that it would be really childish to publish an article on
that.Meanwhile I received enormous messages from people seeking for help. It was
difficult to reply to each one of them. However I didn’t forget about the
problems of readers. So I took a day free asking permission from my mom. And
thought of Hex Editing(Search Google) Ardamax Keylogger to make it FUD. I had to
choose this option because the crypters were no more FUD. People who doesn’t
have patience may not continue because this post is rather lengthy.It took me
4-5 hours to make it FUD though!So lets begin..
You will the following things-
1.File Splitter
2.Hex Editing Software
3. Antivirus
4. And of course the keylogger (in my case i am using ardamax)
To make it easy for you all I have added the screenshots too.
1. First split the keylogger into 4 parts.But how you gonna do that? Divide the bytes by 4 like below:
2. The files will be split in the desired location:
3. Scan them and see which is infected. For me it was install.exe.1:
4.Split this file too and scan them with same process until you don’t get any detection.
5.For me this was the last file that was detected! So I will now open the detected file with the Hex Editor like this:
6. Antiviruses use signatures to detect keyloggers and other malwares. So the trick is here. We have to edit the signature to make it different and the antivirus won’t be able to detect it. It is not easy to find the signature and edit them. So you have to use the trial and error method until you get it right, however this is not enough, editing may interfere with the Remote File and can make it to not work.In my case I changed the following thing:
7. Save the file.Then scan it …
WOW! I made it FUD. Now click on Create_install to compile the file. You are done. If you are successful then comment with your file links.Hope you like my tutorial.
Sincere thanks to HaX0r Enc0de for sharing a similar tut on hex editing trojan!
Please drop your comments and share it! Make sure to Subscribe to Geeky Parigyan by Email and like the Geeky Parigyan FB Page ©2012, Copyright Parigyan Tamuly.
You will the following things-
1.File Splitter
2.Hex Editing Software
3. Antivirus
4. And of course the keylogger (in my case i am using ardamax)
To make it easy for you all I have added the screenshots too.
1. First split the keylogger into 4 parts.But how you gonna do that? Divide the bytes by 4 like below:
3. Scan them and see which is infected. For me it was install.exe.1:
4.Split this file too and scan them with same process until you don’t get any detection.
5.For me this was the last file that was detected! So I will now open the detected file with the Hex Editor like this:
6. Antiviruses use signatures to detect keyloggers and other malwares. So the trick is here. We have to edit the signature to make it different and the antivirus won’t be able to detect it. It is not easy to find the signature and edit them. So you have to use the trial and error method until you get it right, however this is not enough, editing may interfere with the Remote File and can make it to not work.In my case I changed the following thing:
7. Save the file.Then scan it …
WOW! I made it FUD. Now click on Create_install to compile the file. You are done. If you are successful then comment with your file links.Hope you like my tutorial.
Sincere thanks to HaX0r Enc0de for sharing a similar tut on hex editing trojan!
Please drop your comments and share it! Make sure to Subscribe to Geeky Parigyan by Email and like the Geeky Parigyan FB Page ©2012, Copyright Parigyan Tamuly.
after all the main problem is to find signatures. bcoz almost every time after making FUD, it does not work properly. and Finding a signature is a worst problem in Hex editor neo. btw nice post.
ReplyDeleteYes, finding signatures is rather difficult(I mentioned it in point 6.)
ReplyDeletewhr will i see d compile to compile it..n again,i av already insatalled it without binding it..wt cn i do abt it..n lastly..plz why nr we binding it..tnxx
ReplyDeleteHey buddy, when you split the files in a specific folder, the folder will contain the split files and compile_nameofsoftware. Just click it! Binding doesn't make it FUD so some hard work and you will be able to make it FUD by Hex editing.
ReplyDeletePlease could you explain how to find the signatures? Like, what exactly do you mean by the signature? What are you referring to? Please elaborate on it a bit.
ReplyDeleteThanks in advance. Otherwise, good blog!!
Signatures are piece of codes which are almost similar in trojans,viruses and other malwares. So if any similar code is detected in a program then antivirus detects it as Virus.It may be a specific word or a sentence of jumbled words. If we can find that code on the program and edit it a little then it cannot be detected by antivirus anymore. Hope yoy got it!
DeleteThanks for the explanation. However, what are the limits between which we can edit the file using a hex editor but at the same time not to hamper its functioning? As you showed in one of your tutorials, you changed "D" to "d" . Is such a change ok or is there still a risk to hamper the proper function of the program? Thank you very much in advance.
ReplyDeleteI tried trial and error method to get the editing correct. First you gonna edit the remote file and see if it is FUD. If not keep on trying.In some cases you might get a single word and in other you will get jumbled characters! After FUD-ing try the remote file in your own PC and check if its working properly.If not you have to edit it once again. So this is a long process but it can save you some dollars (since you dont need to buy any FUD crypter)
Deletethanks for the explanation
ReplyDeleteInstall.exe it the keylog file which you have created using keylogger..ok... then whats that Create_install file.
ReplyDeleteI did not understand
File created when you split the install.exe
DeleteHi,
ReplyDeleteyou already mentioned that it was trial and error, is there are simple procedure like doing reverse engineering. Iam asking you because i found a video tutorial in youtube 'how to make Ardmax keylogger undetectable 100%'. He used xenocode postbuild.net software before using Hex Editor and finally it was undetectable.
when i tried, there was an error that ' the executable has invalid base rellocation data and please contact support' can you help me in this?
does this work? can you mail me 'muzicbee9@gmail.com'
Thank you
Hmm..I will sure post it on my First Ebook...
ReplyDeleteHi,
ReplyDeleteThank you, waiting for your E-book. May i know, when you are going to post?
As soon as I get some free time
Deletewell in my case im fvcked up.... i cannot split anymore the server exe bc if i do it, the antivirus wouldnt catch the strings anymore (but if i join the parts again it will), the resultant file is still HUGE (around 15Kb) which is a LOT of HEX to check... and throw to the party the fact that most of the characters are just random... i have tried replacing all the coherent text just to check if its from that series of strings but its not...
Deleteany advice?
well in my case im fvcked up.... i cannot split anymore the server exe bc if i do it, the antivirus wouldnt catch the strings anymore (but if i join the parts again it will), the resultant file is still HUGE (around 15Kb) which is a LOT of HEX to check... and throw to the party the fact that most of the characters are just random... i have tried replacing all the coherent text just to check if its from that series of strings but its not...
ReplyDeleteany advice?
Hi,, parigyan ,,,u r doing nice work man,,,CAN U PLZ PROVIDE SNIPER SPY KEYLOGGER FULL VERSION WITH KEY.
ReplyDeleteEheh 10 seconds to make it FUD ^^
ReplyDeleteThink Im lucky, but Karspersky found trojan on my document.
https://www.virustotal.com/file/c4e4f08ee522132eb00c26aab432f6489c7db1a9d3b7fb47d08f182b6def323b/analysis/1343990732/
I made it FUD in 10 seconds....
ReplyDeleteBut karpersky found trojan, can I make it FUD for Karspersky ??
https://www.virustotal.com/file/c4e4f08ee522132eb00c26aab432f6489c7db1a9d3b7fb47d08f182b6def323b/analysis/1343990732/
Is it possible for a anti-virus signature to be located in an essential code? I'm using the same keylogger you are.
ReplyDeleteThanks in advanced :)
This isn't working. When the file splitter joins the files, it makes an MS-DOS executable file, which isn't capable of installing Ardamax. The first sentence in the program's code says "This cannot work in MS-DOS mode" but the file splitter makes it MS-DOS mode. What am I supposed to do?
ReplyDeleteThis isn't working. The hex editor saves the edited file in MS-DOS compability mode, and the app won't run this way (The first sentence of the hex code says "This doesn't run in MS-DOS mode"). How are we supposed to fix this?
ReplyDeleteIt is supposed to make Executables.. What Splitter are you using ?
ReplyDeleteHi Bro,
ReplyDeleteI created 4 parts of my install.exe but the moment I put those files in my unit, Macafee Antivirus just deletes the files itself....So I'am unable to proceed with the Hex Code editing....Any ideas about how shall I proceed now...