‫Let's try to create malware which cannot be detected by the security systems.
‫I'd like to try to create a back door with the MSF venom first.
‫Go to the fat rat folder and run fat rat script.
‫If you let the tool add a shortcut to the system, you don't need to go to the fat rat folder, you
‫can run it from anywhere.
‫It checks all dependent applications in conditions such as Internet connection at the beginning.
‫Don't upload to virus total warning.
‫OK, there are several different methods to create back doors using the fat rat, you can create back
‫doors here using MSF Venom food when avoid Puan winds, etc..
‫In addition, you can add back doors into the original Android apk packages.
‫Let's create a malware with a backdoor using the MSF venom in this example type one and hit enter into
‫the main menu.
‫MSF Venom creator, Modu Menu Appears.
‫Now, since our victim's machines operating system is windows, I chose here, the second option in
‫this menu, it first gives me the IP information of my local machine, then asks for the listener IP
‫address.
‫Thanks for the kindness.
‫Since I use this machine as the listener, I enter its IP address asking for the listener port, I'll
‫choose double five, double five for this time.
‫Now it wants me to enter the base name for the output files that the tool is going to generate while
‫trying to find the correct payload and malware, you may need to try a lot of different options.
‫So to be able to recognize which file I generate for this time, I use the day of the month and the
‫time in file names.
‫For this example, since today is the first day of the month and it's 22 55, I use 01 Dash 22, dash
‫55 as the file name base.
‫Next step is to choose the payload, let's choose Windows slash Metropia to slash reverse underscore
‫TCP.
‫Number three, it uses almost all facilities of MSF venom.
‫It encodes the payload with 10 iterations with Shikata, underscore Geet, underscore NHIN encoding
‫method first, then encodes with another method eight times and three other encodings follow the malicious
‫executable was created.
‫It's in the output folder under the fat rat folder.
‫Now let's go to the victim machine and transfer the file using win SICP, connect to your county machine.
‫Remember, SICP protocol uses the SSA, so be sure that the SSA is running in Kalli.
‫Michael DSH is serving from 443, don't ask why.
‫OK, we connected go to the folder and where our file is root, fat rat output and here it is.
‫Drop it and drag to the desktop of the Windows system.
‫But first, let's start Windows Defender and see if our malware is able to avoid it or not.
‫OK, it's already running now let's transfer the malware into the Windows system.
‫Oops, our malware is detected by Windows Defender.
‫And deleted in a few seconds anyway, there are always some computers which do not have any security
‫protection.
‫Let's examine our malware that works on them, go to Settings Administrator Pain and uncheck the turn
‫on this app checkbox to disable Windows, defender and press save changes.
‫Now, drag the malware again and drop into the desktop.
‫For running the application in the victim machine, let's think about the hacker side.
‫Are we ready as a hacker, what do we need to connect to the back door of the malware succeeds?
‫Sure, we don't have a listener at the moment go to Calli machine to start a listener.
‫Start Métis framework console using MSF console command.
‫While metabolite framework is starting to look at the information of the back door in the terminal where
‫I create it to make sure the payload is the one I used, why?
‫Because I have to use the exact same payload while creating the listener.
‫MSF started type use exploits, multistage handler first.
‫And then set the payload that we used in the malware.
‫Look at the options using the show options command set the host again, I use the information of the
‫malware.
‫Set the port, which was five five five five on my malware.
‫Now, type exploit to start the handler.
‫Go to the victims machine now.
‫And run, the malware we copied a few minutes ago turned back to Cali, you see that in the temperature
‫section is opened once again, the victory is ours.
‫Windows Defender and Windows eight has detected our malware.
‫We should find another way to create an undetectable malware.
‫This time, I'd like to create a malware using and wins the option six, we are now in the main menu
‫of the fat rat to type six and hit enter to use PWI in Windows to create the malware at this time.
‫Pwint Modu menu appears there are different options here to create an exact batch or PDF file.
‫I'd like to use the second option to create an executable malware.
‫Now, when I type two and hit enter, it gives the IP information of my system and asks for the listener
‫host.
‫Enter the L, host the IP of your Cali and L Port, this time I use double six, double six, use whatever
‫you want base name for output files.
‫I use the same format oh one dash two three dash zero two.
‫Again, I choose the third payload reverse underscore TCP.
‫The back door is saved to the output folder.
‫Now let's go to the victim machine and transfer the file using when SICP.
‫Kawi side of win.
‫We're in the output folder of the Fat Ra'ed application before transferring the new malware into the
‫victim's machine.
‫Be sure that Windows Defender is running.
‫I opened the action center and turn on Windows Defender.
‫OK, it's running, I can transfer our new malware now.
‫No, not again, defender detected our new malware as well, and we should try another method, the
‫fat rat is very powerful and I'm sure we can find a way to bypass the defender.
‫I'll try another method of PWI and wins the sixth option of the main menu.
‫This time, I choose the fourth option in P.W. Wynn's menu, I'll again create a malicious executable
‫with a different method.
‫Inputs are all the same.
‫I'll host first, then Laport.
‫I choose double seven, double seven this time, and the base name of the output files.
‫I chose the reverse Tsipi as the payload, the third option.
‫And done the output file is created, let's go back to the victim machine, refresh the Calli side of
‫Witness UQP and drag the newest malware and Esraa up into Windows desktop.
‫As you see at the lower right hand corner, Windows Defender is running and it couldn't detect our malware
‫this time.
‫Well done.
‫We overcame it with the first problem, bypass the security system.
‫Now, the main question is, does the malware work?
‫I mean, do we have the back door?
‫So at this point we go back to Cali and start a listener, start the MSF console.
‫Use exploited multi handler to use the handler.
‫Set the payload, the same one we used in the malware, to be sure, I prefer to copy the payload from
‫the fat rat terminal and paste it set l host the IP address of Kali.
‫And airport, remember, that was seven seven seven seven.
‫I want to look at the open ports using Net Stat Dashti and LPI Linux Command double seven, double seven
‫is not in use at the moment.
‫Back we go to mSv console's terminal and type execute to start the handler.
‫Go to the Windows machine and run the malware by double clicking on it.
‫Back to the Calli machine and a new metro picture session is open now we can say victory is ours.