[Killpot]

Yo.

This thread will be strictly for the .Net Framework, however, this could easily be applied to any other language.

If you doubt my credibility check any of my older threads, I market a crypter currently that is still undetected, albeit private, but it's been months now and it's still FUD, run and scantime.

So lets start with the basics of crypting, what is it?

Well, loosely, it's the idea of taking a detected virus, and encrypting it and putting it inside a "Stub", aka a shell program that doesn't look malicious from the outside, but is just storing the encrypted virus.

There's two main types of crypters, ones that use Droppers, and ones that use RunPEs. A dropper, as you may imagine, just decrypts the virus and "drops" it into a folder (usually temp), and then executes it.
Pros:
- Easily scan-time FUD
- Easy to make
- Good for beginners
Cons:
- Easily detected
- Almost impossible to make run-time FUD

The other type, RunPE, is a much more advanced, it involves memory and is most defiantly not for beginners. While there are some free runpe's most are very detected and the majority of you won't have the slightest of clues on the structure of PEs and how memory works to modify it back to being undetectable. So I would recommend looking at people like AeonHack and Menalix for good examples to learn from.
Pros:
- Can be made very fun
- Difficult to detect
- Gives you many more options
Cons:
- Very difficult to create
- Steep learning curve
- x86 <> x64 can prove to be difficult.

So what is the general flow of a stub?
It goes like this:
1: Program starts
2:Begin by decrypting dll stored in resources(Contains RunPE & Virus)
3:Invoke entry point of dll
4:dll starts
5:Start the desired host program in a suspended state(usually is stub, but can be Chrome, Skype, etc.)
6:adapt file to virtual address space alignment
7:copy headers of the file
8:copy sections
9:parse relocation table
10:apply changes
11:parse IAT & write addresses
12:parse TLS directory if needed
13:invoke entrypoint

Ok, so that's the skeleton, but what about in layman's terms?

So, the whole concept here is we basically just have an empty program that just trys to invoke an entry point of a byte array. Kind of conspicuous, however, via methods like CallByName, and dynamic methods, you can avoid all scantime detection very easily. So, now you take all of the easily detected code, and shove it into a dll, alongside that you will also embed the encrypted virus inside the dll. Then on run time, once you've invoked your dll, it will start by decrypting your encrypted virus, then going through all of the dll steps I listed above. However this won't keep it very runtime FUD, you're going to have to do something to keep the anti-virus' from scanning your process that you injected into. As obviously this will contain the decrypted virus that's easily detected. This can be done in a number of ways and is usually what makes or breaks the crypter, if you don't have a good anti-scanning function it's no better than a dropper.

Useful links:
http://pastebin.com/65yUWZa8
http://pastebin.com/0cB2CiCv
http://pastebin.com/HKkTpLyD

If you're still unsure of everything in the middle, go and look for other crypter sources, chances are you can piece together everything you're missing :^)