How do I collect logs? How to stay hidden and safe from stealers?

[Lord777]

Many of those who read this at least once heard about "logs", first let's figure out what it is in general:

Log - a unit of user data, roughly speaking your log is your entire life on the Internet, all your passwords, logins, cookies, browser history(in some cases including incognito) is reflected in this very log. So most likely, if you've watched porn, the lair owner will see this porn in your story.

Random person's log

But what is so valuable about your usernames and passwords? In general, nothing, most of you in our work simply will not be useful, we do not need your VK contacts where you correspond with your girls, we are specific guys and we have specific sharavars for money, we need guys who have cash.

But where do the logs come from?​

Logs are obtained by means of stealers (read a virus that steals data), the stiller can be "picked up" when downloading crack on Photoshop, on porn sites, on pirated games, so be careful with such things. Most of those who read this will never pick up a serious stiller, for a very simple reason, serious stealers do not work in the CIS, you can pick up crafts of some schoolchildren and students, serious products, for example mars, do not work in the CIS.

How to hide stillers (viruses)​

Now each of us has an antivirus, most of them have the most powerful representative - Windows Defender (code name mssec), the most powerful because it is installed on every Windows user(10+), and on sevens its neutered version, or other antiviruses (Kaspersky, etc.), regardless of what it is installed on each microwave has the largest antivirus sample database. But even this does not help antivirus programs. It's all about cryptors, a good cryptor is able to change the signature of the sample and the virus becomes "clean" for the antivirus database, signature analysis (also called scantime) in a simplified form works like this:

1. to the file virus.exe its identification number is assigned in the antivirus system, for example, 123456

inside the antivirus there are such tables(again, I show them in a simplified way):
virus.exe = 123456
program.exe = 56789

[*]stealer.exe = 98765
[*]When you get a zombie vs plants file on your computer.if the antivirus understands that the only plant is the host of the computer, and calculates its hash, and its hash is 123456, the antivirus checks it with its database, and finds out that this is the name of the file virus.exe after that, another user (who was less lucky and the antivirus didn't know about the virus YET) fucked up the computer. And issues a warning to the user. Thus, as you do not change the file name, as you do not change the icon, if you are fired up - you will have to rebuild the file, or resort to cryptors
[/LIST]

Cryptors are the Biggest Hoax

A normal cryptor can change the same hash of the virus (build. Build file of the virus) from the same tables. But even this does not save from "palev" antiviruses in the future. It's all about the runtime analysis of modern antivirus programs. I will try to tell you in simple words what it is, so, we have the file " open.exe", it is encrypted, when it hits the computer, the antivirus does not swear at it because it did not find its signatures in the database(because it is encrypted again), everything is OK, but then there is such a chain of actions that sends most cryptors to a knockout:

1. You are opening the file "открой.ехе"
2. The antivirus intercepts the open event, and then puts it in a special isolated area in its memory(a virtual machine inside the antivirus) and looks at what it does, checks its behavior. This type of analysis is called runtime, or behavioral analysis in Russian
3. Antivirus even before the file opens in your main machine detects that the file climbs into the password storage of Chrome, to sessions in Telegram, and immediately gives this behavioral fingerprint some kind of detector "Wacatac. B!ml" for example, by the way !ml at the end means that the detector is given by machine learning, in short, the detector issued artificial intelligence.
4. Under the distribution immediately gets the hash of the stiller (remember those tables), as you can see, the cryptor did not help us, despite the fact that it provides FUD (Full undetected) antivirus programs in scanttime, which is also temporarily useful. For this reason, the crypt itself does not live long.

It turns out that cryptors from a part in modern realities are useless because no cryptor can normally protect against runtime analysis, although they have attempts, for example: garbage instructions are added, they are usually not connected in any way, this confuses runtime analysis, random delays are added when opening and much more, I'll say right away that antivirus programs are equally cool to stop all these attempts, especially our favorite Mssec, it detects meaninglessness, incoherency of instructions and gives out the S detector.Kriptik! ml, and everything happens as usual.

But why does everyone use cryptors? They're useless!

Cryptors are useless, but only partially. The fact is that not all users have the "cloud analysis"feature enabled in the same Windows Defender(our runtime analysis). For example, if we infected 1000 users, 500 of them do not have antivirus software at all, because: "do you need it??? I'm fucking smart myself without any of your antivirus programs", 400 have the ability to run-time analysis disabled, because files open longer with it, and only 901 users have an antivirus and run-time analysis is enabled, EXACTLY BEFORE THIS USER, the VIRUS IS ELUSIVE! And cryptor helped us with this! But after 901 users, whose antivirus software has burned down that the virus is a virus, the file will not start for 902, even if the runtime analysis option is disabled. So, the user who has everything turned on is called the last patient)))) then, after it, the build will start only for those users who do not have antivirus programs, this does not happen immediately, in practice, after 901 users, another 200-300 people are quietly infected, before the virus is completely flooded with detectors.

How to stay safe​

Do not turn off and do not cut out Windows Defender in any case, even better if you enable cloud protection, you can do this in the Defender's settings, use it from browsers for important data(just do not fall) yandex.BROWSER, yes, I know that there is a finished Alice, but this is the most secure browser, look right now who is rummaging on the github stiller stealer Yandex browser, although Yandex browser is built on the chrome engine, security algorithms have been changed there, and with its recent update, it completely killed all the stealers that work on it. Well done guys from Yandex respect to them, because the same opera does not bother much with this. By the way more [I WONDER IF ANYONE HAS READ THIS FAR AT ALL? you can use Mozilla Portable, in most cases stealers load libraries needed for stilling Mozilla passwords from the main directory of the browser, and since the Portable version of Mozilla is located not knows where(more precisely, where you want) Stiller simply does not know about it, and the Portable version will not notice.