Lime Crypter v3.1 [Crypter / Binder] (Open Source)

Mr.z3ro · 10-29-2018, 07:47 PM

An obfuscation tool for .Net + Native files. Applying some evasion techniques to bypass anti-virus software and install a persistence in the machine. Also, the output payload can be binded with a legit application while it bytes are being injected to legit process as well.
Main Features:
•.NET - Coded in Visual Basic .NET, required framework 4.0 dependency.
•USG - Adding some junk methods and rename all variables
•Injection - Hide payload behind a legit process
•Anti Virtual Machines - Uninstall itself if the machine is virtual to avoid scanning or analyzing

[Image: iMcfDdr.png]

--------------------------------------------------------------------------------------------------------------------
[Image: 76CoInF.png]

_

--------------------------------------------------------------------------------------------------------------------
[Image: KF2k9w6.png]

_

--------------------------------------------------------------------------------------------------------------------
Before crypt of a Orcus client file with 'Lime Crypter 3.1'.
[Image: mpxS440.png]

Proof: Link

After crypt of a Orcus client file with 'Lime Crypter 3.1'.
[Image: vbrCn0r.png]

Proof: Link

Virustotal:
Virustotal - EXE --MD5: "ced45f6998154c48d72f053029ecbfc7"
Virustotal - ZIP --MD5: "9778a191ab6550b5415c596d1f41d8e1"
Download:
GitHub

mothered · 10-30-2018, 04:22 AM

Even after crypting the file, the detections are quite high. Nonetheless, given It's open-source, It's worthy of analyzing.

I like the following features:
•Injection - Hide payload behind a legit process.
•Anti Virtual Machines.

Appreciate It.

GamerulEDY · 03-10-2022, 06:00 PM

ty for sharing mate i realynedthisman

losebubble · 08-19-2022, 03:48 AM

(10-30-2018, 04:22 AM)mothered Wrote: Even after crypting the file, the detections are quite high. Nonetheless, given It's open-source, It's worthy of analyzing.

I like the following features:
•Injection - Hide payload behind a legit process.
•Anti Virtual Machines.

Appreciate It.

Very clearly for me.

JohnPhillips · 11-05-2022, 12:06 PM

Thanks for the source. Hopefully it won't be that hard to UD it again for windows defender.

The files are deleted from Github.