6

I have written a very simple/basic crypter in C++ and I would like to test it. How would I go about writing a simple MessageBox program that is "tainted" so that my Anti-virus will attempt to quarantine it upon running the file? Right now, I just have a MessageBox outputting "Hello".

I need a suspicious signature.

P.S. It is a runtime crypter. I worked on it after reading this white paper: http://www.exploit-db.com/wp-content/themes/exploit/docs/18849.pdf

Quaxton Hale
  • 267
  • 2
  • 3
  • 8
  • Justin, is your crypter avilable somewhere? I would love to test it! Right now I'm using the Crypter from www.crypter.com , I'm satisfied with it but I would try a new one. To test it against your antivirus, just crypt a detected keylogger and see how's working. –  Nov 08 '13 at 23:07

1 Answers1

12

An idea would be to use the EICAR string. This string was developed to test anti-virus. Try to make a program with that, see if it triggers your av and then apply your crypter.

Lucas Kauffman
  • 54,437
  • 17
  • 116
  • 196
  • Would something like this work? http://pastebin.com/2JZp7LWd

    I compiled it, and it outputs a text file with the EICAR string. The Antivirus did not assume it was a virus. Am I doing something wrong?

     – Quaxton Hale Oct 21 '13 at 21:01
  • Have you run the AV on that file explicitly (like right-click "scan this file") or have you depended on the on-access scanner? In latter case the AV might just miss the access event. You should also check the AV whitelists: sometimes they whitelist files automatically based on some strange rules. – buherator Oct 21 '13 at 21:59
  • That was strange. Now the AV attempts to kill the file as it's being saved. Thank you. – Quaxton Hale Oct 21 '13 at 23:29
  • As lucas suggested above you can try that method, you can also check out Soft Crypter google it, you can maybe use some of their ideas. –  Nov 04 '13 at 12:17
  • @user32779 Thanks. Why would I want to buy a crypter when I can code one myself? I will learn a lot more anyway. – Quaxton Hale Dec 04 '13 at 18:40