Hi all,
I have been watching this ‘bad habit’ that I am going to discuss about, happening very often so it’s time to talk about it.
I have noticed that people tend to use Shellter with the same executables, even when this is not required as I explain later on.
Someone uploads a demo video infecting ‘putty.exe’, then everyone uses that.
Next day someone uploads a video infecting the setup program of ‘Winrar’ and then everyone uses that.
It’s one thing using the same executables for creating videos for educational and demonstration purposes and another using those all the time on VirusTotal and other online multi-AV scanners.
I hate to ruin this for you, but by always using the same executables with Shellter, AV vendors create better heuristics for those specific legitimate executables that you infect.
This is not really effective against Shellter itself but in some cases might fit the purpose, and make things worse for yourself when you really need to convince someone to execute a specific ‘legitimate’ application that you have infected.
