NME 1.1 - Public
- by redlime


Disclaimer:
Swerat or the creator of NME will in no way be held responsible for any damages caused
by the negligent use of this software.
By downloading and using this software you agree to this condition.
If you dont agree to this condition you are not allowed to use this software.

What is NME:
NME is a executable crypter that leaves the crypted file in a executable state.
The whole targetfile is crypted and put inside a stub to avoid detection of the
original file. Upon execution of the crypted file, the stub will decrypt the original
data and load it in memory.
An interesting feature is that you may crypt files that has got data appended at the end
of the file. As an example, Bifrost store its data at the end of the file, and most
crypters/packers would delete those settings, but not NME. NME will automatically append
the settings at the end of the new file, leaving your settings intact.

Features:
* Makes everything undetected
* Loads the decrypted file in memory and does not write it to disc
* Icon may be changed directly in the builder
* Crypting files with data at the end of the file is supported
* ~16.5kb stub
* Manual UPX-packing before crypting is supported (compression)
* Unhooks VirtualAllocEx & WriteProcessMemory to avoid user level-hooking firewalls

Crypted files run on Windows NT and up.
Coded in Delphi 7.

Special Thanks:
* Shapeless
* Aphex
* Positron
* ErazerZ
* StTwister
* The rest of Swerat Team and its members
* p0ke
* Chasenet.org

Undetectables:
If you like this tool and would like a private undetected version i sell unique versions
for the price of $125. You get a totally unique version which only youve got and it will
make almost any executable you throw to it undetected.
The private versions includes a sandbox emulation bypass technique (Nod32) and custom
features may be added on request. Replacement guarantee on detection.
Contact me on redlime@gmail.com for order or more information.


Enjoy this release!

redlime @ Swerat Team
www.swerat.com

NME 1.1 - 13/12 -05
* User Level Unhooking for WriteProcessMemory and VirtualAllocEx
  (SttUnhooker, by StTwister @ Gateofgod.com)
* Minor changes/fixes

NME 1.0 - 9/12 -05
* First public version released!

har den iconstealer lr måste man ha en .ico fil?

vad är koden då ?

Vågar man kolla upp den med virustotal..å kryssa i dont blblbl....

efter jag har packt server
å skulle testa fick den fel medd
http://www.badongo.com/pic.php?file=Eroor_...-12-09_fell.JPG

An interesting feature is that you may crypt files that has got data appended at the end of the file. As an example, Bifrost store its data at the end of the file, and most  crypters/packers would delete those settings, but not NME. NME will automatically append the settings at the end of the new file, leaving your settings intact.

Brandväggar som hookar API's märker att denna versionen av NME använder WriteProcessMemory och VirtualAllocEx.

efter jag packat den med NME så är det inte autostart på servern :S.. den startar liksom inte på vicsen när dom startar datorn? lösning?

Vad står NME för då?

ClamAV 
Found RAT.Gobot-7
VBA32 
Found RAT.Delf.37 (probable variant)

Ingen använder varken VBA32 eller ClamAV så spela roll

Nu har NOD tagit den :(

Använd inte denna tekniken om du inte vill unhooka.. Annars tar brandväggar såsopm Tiny den.

Men det är samma teknik som i 2hc? Alltså starta den egna filen igen och skriva över med det skyddade programmet? Kerio och zonealarm klagade ju inte, men tiny gör det? Och tiny använder bara userlevel hooks? Får ta och ladda ner tiny och prova.

Mitt NOD32 upptäcker den också nu under namnet "Win32/Agent.NAK.RAT"
Vilka AV är den fortfarande UD för ?
Redlime planerar du en ny version snart ? Funderat på att slänga med en binder?

Skyddar denna typ av crypters mot s.k. "heuristic scans"?