[iScythe]

Hello dear AF community!

Recently, as I was browsing Hacking Tools section, I found that, many of you don't scan your file before upload. However a virus scan would be helpful for the users and for yourself too.

In fact, many virus infections caused by downloading and using infected and/or backdoored files. Spreading with hacking tools is a very popular way of spreading a trojan or Remote Administration Tool server. You can see many videos on You tube about hacker tools that in fame of working and if you download you got infected, even if the program really work It can be backdoored or a server can be binded to it. It is dangerous. After you got infected by a this kind of R.A.T., the hacker would have absolute control on your computer and you may won't notice anything, while hacker uses your computer for illegal activity and steal your personal informations (credit card details for example). Sadly, hacker forums are also good targets for these hackers, because there're members who don't ask for virus scan and don't know how to use Sandboxie correctly. It is not a problem, if you don't understand IT so much, but it is your own responsibility to read after these stuff and read this thread.

Don't fall into the trap of Social Engineers! Always check the feedbacks about the tool, but don't forget about your own safety. It is able to SE full communities and get "trusted" Vouches, even if the tool is backdoored. The most HQ and Neat tools can be infected aswell. Don't let trick yourself! If uploader can't show you clear proof, avoid the thread. It is your right and responsibility to avoid these traps. If You know about a tool It's infected, You MUST report it public to the community and/or in private to the Admin as fast as you can. If You don't do this, You help hackers to harm other AF members and to break the fame of the forum.

You should know about Java Drive By(s) and Infected sites. You may don't download anything "manually", but enough to click on the wrong link and you got infected. It can be done via JDB(s) and other Infected Sites too. As JDBs are becoming more and more popular, the number of infections done by these JDBs is increasing. It is not an art to get a JDB into working, so be careful. Check the url before click on it. If You're not sure It is a trusted site (check it carefully, normally there're only one or two letter difference), then you could scan the link itself online.

A Virus Scan is not just a word, but a complex log about the file. In these days, there're many versions of viruses, crypted servers and other harmful tools. It is not enough to know file is "0/35" for example. You have to learn how to read and understand these logs atleast at basic level. A Virus Scan is necessary right before downloading the file itself, because downloading a possible infected file onto your computer is always endanger your safety. To scan files, you should use VirusTotal or ElementScanner. The difference is that, ElementScanner doesn't send your file to AV companies, which means It will stay FUD if It is FUD.

VirusTotal sends your file to AV companies, so if you have a FUD crypter for example, don't scan it on VirusTotal. If file doesn't necessitate scanning with ElementScanner (so It's not a crypter or alike), always ask for a VirusTotal scan. That is a false information "It is a hacker tool, of course it shows up as a virus!". Maybe It is a hacker tool, but It is a program too, so if It doesn't contains harmful parts for the user and binded servers or backdoors, It won't show up as a virus. Important note: There're false positive cases. Always check the infection type itself. A trojan is always suspicious. If you don't understand the infection type, look after it via Google. Decide if It is false positive or dangerous. I mentioned, a virus scan isn't only a number, but many informations. You can check the details too and You can get to know if file has been modified (which is always suspicious). A modifications can be a bind for example. If It's detected, then you're lucky, because you can read what type of server has been binded to the file, what crypter did hacker use...etc. But, it can be FUD aswell. FUD or not, if It has been modified SHA256 code will be changed. The difference between original SHA256 code and your file's code is always suspicious. If uploader says It is the original file, SHA256 MUST be the same with the original or he lied.

After you've downloaded the file onto your computer, I recommend starting it in Sandboxie. With Sandboxie, You can see what files does It modify and after usage, You can delete your sandbox's content, so virus will be removed too. Important note: There're R.A.T.(s) on MAC OS and Linux too, so usage of a Virtual Computer (or Sandboxie) is always recommended when you first start a file.


Monitor your network. Sandboxie will protect you from many infections, but there're some exceptions that can trick out Sandboxie. If you're monitoring your network (e.g.: via TeamViewer), then You'll see if some suspicious packets leave or come. Keep your eyes on your own network!

Ask for Source Code if you can! Obviously, there're some premium tools where owners won't give out source code, but at free tools if It is made by the uploader, always ask for the source. A virus scan can be replaced and saved by the source code. After you got the source, attempt to compile it yourself. Who knows, if the source is the same with the uploaded .exe file's one.

Make sure, the uploaded proof is the real proof! Always scan it on your own too and compare it with the uploader's scan.

Hall of links:

- Official tutorial about Sandboxie usage.

- iScythe's White-hat Help Thread (coming soon to AF too )

Hall of pictures:


Note: If you've got anything to add this thread post here! I'm going to update this time for time.