InsanityProtector

Private Version 1.7 (05-05-2019)

• Added functionality to run .NET compiled using CLR Memory Hosting. (Works perfectly together with the privilege elevation "UAC Bypass - Mocking Trusted Directory")
• Small errors were corrected for perfect execution in some versions of Windows 10.
• It has an interface with more insanity than ever.

Vídeo:

Private Version 1.6 (29-11-2018)

• Development in FASM an UAC Bypass - Mocking Trusted Directory.

 

Private Version 1.5 (04-02-2018)

• Bypass RunPE detector personal method.
• New method of compressing executables with obfuscate packer.

  
Insanity Protector 1.4 (23-09-2017)

Insanity has been tested running alongside RATs with the following antivirus applications and their default settings:

• Kaspersky Internet Security
• McAfee
• Avast Professional
• AVG Professional
• NOD32 Internet Security
• Avira Professional
• Avira Free
• Windows Defender 7, 8.1 and 10

It is important to emphasize that the tests have been done with completely new trojans or modifications have been made to the known trojans to avoid antivirus detection based on their connection frames, file creation or access to registry paths.

New selection options:

• Different persistence methods have been added to the system, such as by direct access (LNK).
• Using the default configuration all loaders are polymorphic.
• It has been increased in five seconds the delay time to avoid the analysis in memory by some antivirus.
• Fixed a bug with the modified RunPE Shellcode.

DISCLAIMER

This application is designed exclusively for educational purposes and I am not responsible for the misuse that other people may give Insanity Protector software or the information set forth herein.

Download Insanity Protector
Pass: 4n0nym0us

Insanity Protector 1.3 (26-04-2017)

This new version of Insanity Protector, is again completely undetectable.

Four new features have been added to the tool:

• The names of the controls for each loader are modified.
• The contents of the internal images are modified for each loader.
• The PE header is modified by adding the actual timestamp for each loader.
• Important, Intelligent... If you use any polymorphic mode check this option. The PE header is modified by adding the CheckSum of the new loader.

Fixed bugs:

• Now I am much more attractive ;)

Making loader:

DISCLAIMER

This application is designed exclusively for educational purposes and I am not responsible for the misuse that other people may give Insanity Protector software or the information set forth herein.

Download Insanity Protector

Pass: 4n0nym0us

Insanity Protector 1.2 (01-02-2017)

This new version of Insanity Protector, is again completely undetectable.

Four new features have been added to the tool:

• It is now possible to sleep the process before the malware is decoded in memory, this will help to avoid the analysis of the antivirus in memory, is working perfectly with the new technologies CyberCapture (DeepScreen) Avast and AVG.
•  Added a modified RunPE Shellcode, to avoid detections with hooks.
• The "Installation Name" button has been added, with which it is possible to modify the Loader name and the Windows registry path.
• A new function allows you to generate a different loader for each use, adding polymorphism.

Fixed bugs:

• Now it works on all Windows 10 operating systems.
• Fixed problems with UPX compression and creation of encrypted binary

Making loader:

FUD Scans

Loader
Polymorphic Loader With All Options 
Protected.exe

DISCLAIMER
This application is designed exclusively for educational purposes and I am not responsible for the misuse that other people may give Insanity Protector software or the information set forth herein.

Download Insanity Protector
Pass: 4n0nym0us

Insanity Protector v1.1 (24-12-2016)

This new version of Insanity Protector, it's again fully undetectable. In the anti-virus evasion tests I've done this time, I want to emphasize the good functioning of NOD32 antivirus detection routines.

It has been added two options to the tool, so you can choose whether you want to compress your sample with UPX or even run it with the system start.

If you choose the option "Start the loader with Windows", by default the installation path is in% AppData% and the auto start key is the one of the current user.

The problems of execution of the samples in Windows 10, come from Minor/MajorOSVersion. I encourage you to make tests.

Making loader:

FUD Scans

Loader

Protected.exe

DISCLAIMER
This application is designed exclusively for educational purposes and I am not responsible for the misuse that other people may give Insanity Protector software or the information set forth herein.

Download Insanity Protector

Pass: 4n0nym0us

Insanity Protector v1.0 (23-11-2016)

The proof of concept that in this blog is shown, is based on making a completely undetectable software protector for all the antivirus without making modifications on the binary after the compilation.

Tested Insanity Protector
Windows 7, 8.1, 10.

Loader

• It uses two encryption algorithms to prevent antivirus detection after joining with your app. This method is able to Bypass AVs proactives.
• The loader is developed in Visual Basic 6, currently compiled in PECode and FUD.
• Your application will be compressed with UPX by Insanity Software before being encrypted.
• An encrypted RunPE method is used and is out of the loader.
• The loader and the encrypted file are joined with Iexpress. It is also FUD.

Loader content

(Loader & Protected.exe)

DISCLAIMER This application is designed exclusively for educational purposes and I am not responsible for the misuse that other people may give Insanity Protector software or the information set forth herein.

Download Insanity Protector

Pass: 4n0nym0us