Jump to content
Tuts 4 You
Sign in to follow this  
Amer

RunPE Detector

Recommended Posts

RDGMax

Here a simple anti Phrozen RunPE Detector

 

23.jpg

RunPE Undetected.rar

This solution can bypass  Phrozen RunPE Detector on memory!

I spent 30 minutes on this lame security software ( Phrozen RunPE Detector )

Edited by RDGMax (see edit history)
  • Like 1

Share this post


Link to post
Amer

the target is detected:

https://www.metadefender.com/#!/results/file/ZTE2MTAyOXJrQngzUTk5R3h4UzE4ZzJYOTVNbGw/regular/analysis

First uploaded 2016-10-29 21:52:20 GMT
Last scanned 2016-10-29 21:52:20 GMT
Filetype Win32 Executable Microsoft Visual Basic 6
File size 524 KB
MD5 B162D7E8A29DA06EF22F7C3AFF270E05
SHA1 EC6013FB643ED49C22DA2DB51B0DBD1D21C3DB64
SHA256 0BD6FB12A8454C28663F2F773CC3C9E765B55D409461F50CCEEA3C852509D4C8

If you use write Process memory so that wrong way to protect runpe method.

Really I'm not interested to analyze a detected target by virus scan engine.

Regards

 

Share this post


Link to post
evlncrn8

'wrong way' ? you mean we're not allowed to use apis to patch the process memory of runpe ?

Share this post


Link to post
Amer
12 hours ago, evlncrn8 said:

'wrong way' ? you mean we're not allowed to use apis to patch the process memory of runpe ?

no i did not meant you're own process i meant the detector memory, actually writing to runpe memory is good but not enough to make it FUD.

tray to run the protected by DRGMax and RunPE Detector inside sandboxie then double click on the runpe, then you'll sea  the different.

take a look at this tool:

by the way this topic is not a Anti-RunPE challenge, it is just to inform about Phrozen RunPE Detector.

Regards

01.JPG

Edited by Amer (see edit history)

Share this post


Link to post
Amer

Negative result in case anti dump Method (Zero Memory or Move Memory).

ZeroMem.JPG

Share this post


Link to post

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  
×
×
  • Create New...