I come back in this video, we're going to look at obfuscating reflective loading screens.
In a previous setting, we've already built our strategy.
You know, the drill and also embedded in his site.
You know, in fact, you Drugeon.
There is a string in sight.
The reflective gal can be detected by antivirus scanners.
So if you look at do you use these to you, which are just open from here to look at the defective DNA
spots?
So rejecting reflective detail into peace to you.
And then look at the experts, you will find it the eye spots contain the function reflective load.
And this can be detected by antivirus is effective.
No, the technology is already well known.
So another problem is when you run nitrogen, you can also see the string reflected loading in memory.
So that is no use existed before the big.
And look, how Trojan.
Reflective to GHC.
My options settings for sovereign preferences on entry point is check.
Now I'll put breakpoint on create trip time BP, create trip hit, enter breakpoint set and you can
go to both points.
You can see I have one breakpoint on great track, so now I'll run this and you hit my creator breakpoint
and our lady execute creates right API function by clicking this icon run to years.
Now he has created a threat.
So now I'm going to search the memory for the string reflecting loader to do that directly.
And you are here.
Go down to search for all mode use button.
And then in here, I think the string reflective load.
And I think, OK.
So you researched this betting advice in memory.
And he's found two leads.
So let's see this in in dumb memory dump.
So I click CPU, select dumb one is a default.
And then under the results in the references, I follow this pie in the memory by right clicking follow
in them.
So no choice in that one.
The location where the string is found, in fact, Loader now is selling them to SFO and then go back
to the references resource in in the second dress, click following done.
And he shows me down to the location where the string factory loader is found.
So it seems that reflective loader is found in the memory so during runtime and can be detected by antivirus.
And he's also found in Yippie studio in the file itself.
So we need to find a way to obfuscate the string.
So let's try it now to stop this.
So to obfuscate the string, we will make some changes to the south school and recompile.
So the first five, we need to make changes in these different viewers, Larry, So.
So we're actually on this relatively flat loader not see opening a look back plus plus.
And then scroll down, you will find this line over here where you define your effective loading him.
And I've also put a command to rename this string to evict a string skin.
So this is the defined and its use in here, the effective loading.
So in order to obfuscate history, we change it to harmless sounding string.
So to do that, all you need to do is.
Change his name to something else, so let me just copy this and then basically down here and up here,
how we just commend this line up and down here, how we just give it a innocent sounding in unison sounding
name, for example, windows.
32.
Something like that means Windows $282 are, for example.
Then I see.
And then.
Oh, maybe.
Yeah.
So that any casual observer would not think twice about this, so I changed to this name with this idea
so that any casual observer would not notice this has been suspicious.
So I just say this now.
You know, I also copied a string here, a mean disingenuous in another file.
The Trojan itself.
So you open the Trojan yourself with Nokia Plus Plus and here also you see to define effective learning.
And here you also change it to an innocent sounding name.
The same is the one here.
OK, so you do see these two changes.
You can now be compatible.
So let's compile the.
That's recompile.
The deal first.
OK.
There is not there are no errors so that it's not encrypted.
So now I've got the encrypted string seen here, encrypted data.
So now head over to that string.
Opening look bad plus plus.
You know this Copia, his new cryptic halo.
Opened my Drugeon
with no purpose plus.
Scroll down and paste it into the.
People here first, I said this in Dili and at best new paper, I do the same for ESG.
I select the ESG and I come here and replace those with the new key.
Then I save it, and now I will rebuild my project.
First, I change to the Trojan directory and I will by.
First, I would test to make sure it is still working effectively to Juniac hit enter, and it still
works.
As you can see, Bing has just opened.
No, I will open the studio.
And I will go and drink my dear, you know, reflective gear in the studio and take a look at spots.
And now you see the effect, even though the string is gone, it's now go industry to the ale, which
appears quite harmless.
So that does it for the air.
Now let us analyze it with A.G..
I will put my.
Georgian memory prices today.
So let me run it now.
You hit a break point.
Let me, ladies, that is not executing the creator.
And by clicking is done two years ago.
And now let us search for effective, you know, the string right click here anyway.
Search for all use pattern in here that reflect the load and then click OK.
And you find.
The fact you load a string is now gone from memory.
So this is how you can obfuscate their effective loader string in your effective Trojan.
That's all for this video.
Thank you for watching.