+- Sinisterly (https://sinister.ly)
+-- Forum: Hacking (https://sinister.ly/Forum-Hacking)
+--- Forum: Tutorials (https://sinister.ly/Forum-Tutorials)
+--- Thread: Using SFX archives to bind FUD malwares (/Thread-Using-SFX-archives-to-bind-FUD-malwares)
Using SFX archives to bind FUD malwares - unknownAttacker - 09-30-2012
Making SFX malware
So you wrote a virus or keylogger or something like that. It's FUD so you don't have to worry about crypting or maybe you've already crypted it. There's just one problem - it's just a small .exe that no-one in right mind would click or even download.
Binding is the solution but it's not without problems - antivirus software can detect them easily. Fortunately, there is a legitimate way to bind your malware to a clean file for easier spreading: SFX archives.
SFX archive is, simply speaking, an archive with an installer so you don't need any software to unpack it. They were extremely popular in the past, rarely used nowadays - but many archiving programs like winrar still support them. More interestingly, with a little bit of knowledge you can hide the installer and make your SFX archive execute some or all of its content after unpacking. You know where I'm going with it, right?
The easiest way to create a malicious SFX archive is by using Windows program called iexpress. Just type iexpress into command line and you're using it. Run the program, chose 'Create new SED' and click next, then choose 'Extract files and run an installation command' and click next. Choose a name and all that bullshit, select 'No prompt' -> 'Do not display a license' -> add both files you want to bind -> set 'install program' to run your legit program and post install command to run a malware -> choose 'hidden' -> choose 'no message' -> hide progress animation -> no restart. Use some program to change the icon and you have a legitimate-looking but backdoored software.
If you want more flexibility, you can create malicious SFX archives with compression software like WinRAR. When creating an archive choose 'Create SFX archive' from 'General' tab, then go to 'Advanced' tab and click 'SFX options'. There you'll have many tabs to customize your archice. My advice: make it so that it will unpack to temp folder (use absolute path function), choose to run both malware and legit file after unpacking, make everything hidden and use console mode and switch off every possible prompt for users.
Also, remember that it will only work if your malware is already FUD. If an antivirus can detect it alone, it will detect it in archive. This is not meant to increase undetectability but as a social engineering technique for easier spreading.
Detecting SFX malware
Even if malware is FUD, SFX is not perfect. How do you know if there's something inside that file you just downloaded? It's simple, you just need to be cautious. There is no need for any program to check it or for file analysis - your Windows (obviously, other systems are not so big on the whole one-click installation thing) and compression software already recognize those archives. Check file properties and you'll see 'Archive' tab. Also, software like WinRAR will be able to open it just like normal archive.
Of course it alone doesn't mean that your file is backdoored, it just means it's an SFX archive. There are legitimate uses for it (installer programs might be SFX archives) so don't panic. Simply check what's inside the archive with WinRAR or other compression software. Basically, if it contains just two exe files, one of which is what you downloaded and other one is some small nondescript application, it's backdoored. If it contains many files and one of them is a small nondescript application, it's probably backdoored. If you're not sure, try comparing crc and md5 checksums (if they are provided by distributor of course).
Making plausible malware SFX or installer
While it wouldn't be practical (also, it probably wouldn't be possible) to achieve crc and md5 collision, you might try to make your malware look plausible so that an experienced user will not notice it when looking into the archive. You just need a little bit of creativity. My idea of doing it is:
1. Download a program installer or video game disc image.
a) if it's installer, proceed to the next step
b) it it's disc image, extract it and continue working with Setup.exe (or however its named on your game)
2. Decompile the installer (you can use Universal Extractor).
3. Change the icon and filename of your malware to something relevant, maybe pump filesize a little bit.
4. Create a non-hidden SFX archive or an installer (pay attention to how the original installer was working so that your software will work after backdoored install). Make it so it will run the malware after install.
5. Change installer's icon and filename to those of the original installer.
6. If it was from a disc image, replace installer inside it with your backdoored installer and spread now-backdoored ISO. If it was just an installer, spread backdoored installer. Warez forums and p2p networks are good for spread.
Now the only way to detect is by comparing the backdoored archive with original one or by comparing the aforementioned checksums.