Trying to decrypt VB .Net keyloggers - Developers

[QUOTE=dajoh;34963217]Or you could just not give it any login info? It's not required.[/QUOTE] Ok, let's try that. [code] EHLO RELAY STARTTLS MAIL FROM: not@gmail.com <window closes> [/code] [editline]2nd March 2012[/editline] [img]http://i.imgur.com/21p5T.png[/img] [editline]2nd March 2012[/editline] [img]http://i.imgur.com/pdqlm.png[/img]

[QUOTE=supersnail11;34963534]Ok, let's try that. ...[/QUOTE] Use an email provider that doesn't require authentication then. [img]http://puu.sh/jbp9[/img] [img]http://puu.sh/jbou[/img]

damn you with your obscure emails thx soda i m l33t hakkur

[QUOTE=supersnail11;34964369]damn you with your obscure emails [/QUOTE] It's called "hotmail.com".

[QUOTE=Dlaor-guy;34964706]It's called "hotmail.com".[/QUOTE] lavabit is not hotmail

[QUOTE=dajoh;34964109]Use an email provider that doesn't require authentication then. [img]http://puu.sh/jbp9[/img] [img]http://puu.sh/jbou[/img][/QUOTE] There must be a reason then, or can they really be that dumb?

[QUOTE=Giacomand;34965053]There must be a reason then, or can they really be that dumb?[/QUOTE] You can disable authentication on your account. [editline]2nd March 2012[/editline] [img]http://dl.dropbox.com/u/23280705/itdunwerk.gif[/img] Hotmail does not work. Hint: the connection is closed when authentication is not provided

[QUOTE=supersnail11;34964809]lavabit is not hotmail[/QUOTE] What I'm trying to say is that Hotmail doesn't require authentication. (As in if you want to send an email from/to a Hotmail address, don't use their email servers)

[QUOTE=Dlaor-guy;34966117]What I'm trying to say is that Hotmail doesn't require authentication. (As in if you want to send an email from/to a Hotmail address, don't use their email servers)[/QUOTE] Uhh, no shit you don't need authentication to set the from address. You need authentication to send email, and that's the discussion.

Oh boy, Unknown Logger has available source code for version 1.2 Time to get modifying

[QUOTE=supersnail11;34969690]Oh boy, Unknown Logger has available source code for version 1.2 Time to get modifying[/QUOTE] I did some graphic work for one of the owners and got a free copy.. [editline]...[/editline] Back when it wasn't publicly released.

[QUOTE=marvincmarvin;34969878]I did some graphic work for one of the owners and got a free copy..[/QUOTE] It is free... Do you mean Project Neptune?

[QUOTE=supersnail11;34969891]It is free... Do you mean Project Neptune?[/QUOTE] No. It was the private version (1.2.4 I believe) Project Neptune is free isn't it?

[QUOTE=marvincmarvin;34970184]No. It was the private version (1.2.4 I believe) Project Neptune is free isn't it?[/QUOTE] Free with limited features or premium if you pay for a donation.

How bout a way around RunPE...

[QUOTE=Se1f_Distruct;34988198]How bout a way around RunPE...[/QUOTE] When it is loading a .net proccess, you can just make a version of the program calling RunPE than after decrypting the assembly, instead saves those bytes to a file rather then calling RunPE with it, then just use reflector or other program to decompile that new file. of course for safety reasosn when I say create a version, I mean pull out the decrypting / crypted assembly all together, and putting it in a new program to test.

Oh look, Soda's on a dumbing spree again.

[QUOTE=Chris220;34989390]Oh look, Soda's on a dumbing spree again.[/QUOTE] As I said in the other thread, and was partially said in this one, I think it is time to just ignore him, unless he has a lot better argument hidden away then he has been spouting out, he is not going to stop anyone enjoying what they find fun. As long as we ignore his attempts to cause arguments.

[QUOTE=nekosune;34989472]As I said in the other thread, and was partially said in this one, I think it is time to just ignore him, unless he has a lot better argument hidden away then he has been spouting out, he is not going to stop anyone enjoying what they find fun. As long as we ignore his attempts to cause arguments.[/QUOTE] Yeah, I posted that in the RE thread. I was pointing out the rating spam in the hope a mod might ban him for rating abuse as has happened before... :v:

[QUOTE=nekosune;34989326]When it is loading a .net proccess, you can just make a version of the program calling RunPE than after decrypting the assembly, instead saves those bytes to a file rather then calling RunPE with it, then just use reflector or other program to decompile that new file. of course for safety reasosn when I say create a version, I mean pull out the decrypting / crypted assembly all together, and putting it in a new program to test.[/QUOTE] Now it seems so simple...I was overcomplicating things again. Perhaps I'll get around to coding a RunPE extracter so next time 80% of the work is already done...

Dear -snip-, Don't use the same GMail you use for everything for your keylogger. Sincerely, Me. [editline]11th March 2012[/editline] Phone number -snip- [highlight](User was banned for this post ("Posting personal information" - Gran PC))[/highlight]

Sign him up for everyone telemarketer you can find!

my "slightly modified" version of unknown logger is out uses lavabit so don't even try

[QUOTE=supersnail11;35100336]my "slightly modified" version of unknown logger is out uses lavabit so don't even try[/QUOTE] [img]http://puu.sh/kxzI[/img] [img]http://puu.sh/kxzi[/img]

Some guy left his gmail info without any attempt at covering it up. His security question was "What is your favorite game?" which was runescape of course. :v:

How do I safely decompile those keyloggers. Some of them seem to be normal trojans and not script kiddy jokes. Something with sandboxy?

[QUOTE=aurum481;35150244]How do I safely decompile those keyloggers. Some of them seem to be normal trojans and not script kiddy jokes. Something with sandboxy?[/QUOTE] You just don't run it.

[QUOTE=aurum481;35150244]How do I safely decompile those keyloggers. Some of them seem to be normal trojans and not script kiddy jokes. Something with sandboxy?[/QUOTE] decompiling these things does not run it, I for safety rename all .exes in it to .dll reflector still reads it fine, and it means i can't accidentally double click on one.

[QUOTE=nekosune;35152740]decompiling these things does not run it, I for safety rename all .exes in it to .dll reflector still reads it fine, and it means i can't accidentally double click on one.[/QUOTE] You could mess with reflector and load text files if you really wanted to.

[QUOTE=marvincmarvin;35152907]You could mess with reflector and load text files if you really wanted to.[/QUOTE] Ahh, okay, I allways changed to dll because was still a binary format that .net used, I may just change to some random extention from now on then.