☘️ { 𝔖𝔠𝔞𝔯𝔩𝔢𝔱𝔱𝔞'𝔰 𝔏𝔬𝔲𝔫𝔤𝔢 } ☘️

Rule number 3 — You are only doing the victim a favor. Let the victim think that it is not she who is helping you, but that you are helping her.

Rule number 2 — Take time by creating the illusion that the victim is not alone. Never let the victim think for even a second that you are desperate and have only 1 client. Use the standard “Just a second”, “Sorry, I need to answer”, etc., thanks to this simple action the person will be more interested in communicating with you.

Rule number 1 — Never put pressure on the victim. Quite often I notice that the guys, when communicating with the victim, put a lot of pressure, I think that this way the person will agree to something faster, but no, this is absolutely not the case. Not all people are stupid vegetables, they won’t just give you your password or money, they want trust. If you failed to inspire confidence in the victim in the first conversation, write that you are busy and reschedule the conversation for tomorrow. By doing this, you will win over the victim and inspire confidence.

10 important rules of Social Engineering 🙊 This is an article about social engineering.

short entry in DNS.* • *It allows senders to request aggregated and anonymized reports from recipients regarding unauthenticated email that claims to be from their domains.* • *It creates a way for ISPs to supply that data in a standardized format.* These reports allow domain owners to monitor possible spoofing of their domains. This is especially useful for commonly abused businesses such as banks, online payment systems, various social media, etc. DMARC does not allow senders to bypass spam filters. Some ISPs take DMARC alignment into consideration in their filtering decisions.• *In DMARC alignment: a message must pass 'SPF authentication' and ‘SPF alignment' and/or 'DKIM authentication' and 'DKIM alignment.’ DKIM alignment: 'd=' must match FRIENDLY FROM SPF alignment: RETURN-PATH must match the FRIENDLY FROM domain Transport Layer Security (TLS) is an encryption method used to encrypt the communication channel between two computers. • *It is the successor to SSL, and the two terms are often used interchangeably.* • *SSL/TLS are widely used to encrypt connections over the internet.* For example: whenever a lock appears in the browser bar, the browser is encrypting communication between you and the website that has been connected to. TLS can be used to encrypt email during the transmission stages. Some recipients require it and will refuse mail that is not TLS encrypted, but that is not very common yet. Many MTAs have the option to request TLS if it available, and will fail over to an unencrypted connection if it is not.

• *Misconfigured SMTP servers may have problems delivering email to many networks.* SMTP servers should be configured with correct forward and reverse DNS and HELO/ EHLO values. • *DNS is used to resolve a domain name to an IP address.* This act is known as a forward DNS and is performed every time you visit a site on the internet. *Reverse DNS (rDNS) is a method of resolving an IP address back to a hostname.* Your hosting company or email service provider can help set this up or correct it. ◦ *If you need to correct your rDNS and are using OVH cloud or Amazon cloud (Lightsail) they have information on their websites that can help.* ◦ *The forward DNS lookup (domain name to IP address) of your IP should match the HELO value set in your server.* • *HELO is an SMTP command sent by an email server to identify itself when connecting to another email server, to start the process of sending an email.* It is followed with the sending email server's hostname. ◦ *One way of testing whether an SMTP server is misconfigured is to send an email from it to helocheck@abuseat.org.* A bounce will immediately be returned that contains the required information. ◦ *Common misconfigurations of HELO are: "localhost.localdomain", "WIN- XYZPDQ01" or "mail".* ◦ *A HELO/EHLO value should be a fully qualified domain name (FQDN)* If the IP is not a mail server, or the HELO settings are in fact correct, check for malware or a misconfigured process. You may need to contact your IT department, network engineer, MTA vendor or hosting company for help. _Email Authentication:_ SPF, DKIM & DMARC (and TLS) SPF and DKIM are authentication protocols that should be considered a must-have requirement in any modern email marketing infrastructure. • *The lack of SPF and DKIM authentication will damage deliverability and affects reputation and inbox placement.* Both SPF and DKIM protocols are used for DMARC, which is increasing rapidly in its importance, particularly for financial institutions. Sender Policy Framework (SPF) allows the authoritative owner of a given domain to specify to a receiver which networks or IPs are authorized to send mail using that domain as a 'from' address. • *The Sender Policy Framework is defined in RFC 7208.* • *Single IPs, IP ranges, or hostnames can be used.* • *An SPF TXT record should be as exclusive as possible for greatest security.* This TXT record lives in the DNS zone file for the sending domain. • *Email should not be sent without verified SPF authentication.* DomainKeys Identified Mail (DKIM) allows the cryptographic signature of a designated portion of the email header so the receiver can verify the authority of the sending domain. • *It makes use of both public and private keys.* • *It has become a crucial part of deliverability and email should never be sent without it.* • *Failure to include a valid DKIM signature will affect deliverability and inbox placement at many ISPs.* Domain-based Message Authentication, Reporting and Conformance (DMARC) is an authentication policy that allows senders to specify to receivers how to respond when email fails SPF or DKIM checks. • *It is published by means of a

📧 _IMPROVE EMAIL DELIVERABILITY_ 📧 Deliverability is all about sending mail users want and expect to receive. The key to good deliverability is getting permission from recipients and meeting their expectations, as well as creating and maintaining an excellent IP address and domain reputation. _CLICK HERE TO CHECKOUT GOOD SENDING DOMAIN PRACTICES_ There are some technical and process pieces as well, including: • *Authentication* • *Sending mail users want* • *Address acquisition and list hygiene* • *Complaint management* • *Frequency and engagement* It is strongly recommended that work be done to segment out anyone that has not actively engaged with your email in a chosen amount of time. The usual starting place is 1 year, and then moving to 6 months, 3 months, etc. depending on results. Flawed address collection processes and bad sending practices result in spamtraps being added to mailing lists. The presence of spamtraps confirms the underlying data problems, so we would furthermore recommend: • *A rigorous review of how data is collected and verified,* • *Adding CAPTCHA to any webforms that may be insecure,* • *Ensuring that a confirmation email is sent to any new subscribers.* This helps prevent both malicious signups and typographical mistakes. If the prospect does not respond to the confirmation email, no further email should be sent to that address. • This process will greatly improve the quality of mailing lists, increase ROI, and significantly reduce the possibility of hitting spam traps. This seems like a silly thing to say, but it is not. In the world of sending email and spam filtering, intention matters less than appearances. If a company that is sending legitimate, COI email in a manner that is indistinguishable from the bad guys, no spam filter will understand the difference. It is important to follow best practices in order to avoid this pitfall. Legitimate mailers work hard to build brand reputation based on a real business address, a known domain and a small, permanent, well-identified range of sending IPs. • *All emails should be correctly authenticated with DKIM & SPF at a minimum* • *The SPF record should be as narrow and specific as possible.* If the entire internet is designated as "permitted sender", that is not useful and opens the domain to abuse by spammers. • *Do not use anonymized or unidentifiable whois records.* Legitimate businesses should have no reason to hide their online identity using whois privacy or proxy services. • *Limit domain usage.* The more unique domains are used to send the same emails, the more red flags are raised; use the primary business domain whenever possible. • *Use clear and consistent naming schemes in DNS - keep it simple.* ◦ *The best option is delegating a subdomain of the brand's primary domain* to the ESP: email.customerbrand.com ◦ *Next best would be: "customerbrand.espdomain.com"* ◦ *Last (and to be avoided if at all possible) resort: customerbrand- email.com* - if this is necessary, it is crucial to use a cousin domain that has a clear relationship to the primary brand name. Phishing has made people very wary of look-alikes. ◦ *This allows receivers to easily distinguish the ESP and customer and reduces the chances of blocks or reputation damage due to unclear identification* • *Use properly registered domains with working mail AND web addresses.* There should be a website for every domain/brand that is being sent. Not having one looks shady and is something that spammers do all the time. • *Every domain that sends email should have functional abuse@ & postmaster@ addresses* • *Use contiguous IPs if possible.* Use the same network. ◦ *If not possible, do not use more IPs than needed.* ◦ *Most brands do not need 100s of IPs scattered across multiple networks -* this is in fact the definition of snowshoeing. Misconfigured SMTP Server: To ensure uninterrupted email delivery, it is critical that all technical settings be correct. In case of difficulty, they should be double checked.

And now what i can do We look for crypters on the market, check their scanning methods, test crypts on live machines. If everything is good, we work. If there are discrepancies with the check services, we try to come to an agreement, please provide proof of the crypt in runtime. If they don’t want it, we look further. Don’t give up, adequate crypters exist, you just need to find them.

What is a smartscreen and why you can't bypass it SmartScreen is a feature that is the last line of defense in Windows 10. It can be a pain for system administrators and of limited practical value for regular users. In theory, the purpose of this function is to check the certification of files and block files without a trusted certificate. However, in practice, the smartscreen works unstable and unpredictably, like a drug addict under the influence of various drugs. It can block good files and allow bad ones, ignore untrusted files, and generate errors for files with a valid signature. The problem is that about 30% of computers receive a message from the smartscreen that it is impossible to verify the file signature. There are several ways to work around this problem, but there are no guaranteed methods. Using a valid certificate may slightly reduce the number of errors, but it will not completely solve the problem. Some files may be blocked even with a license or digital signature. Thus, you can solve this problem either by accepting it or by trying to use a valid certificate. Purchasing a certificate from a reputable provider like Comodo can save you money and avoid some hassles.

Uploading a file to the browser Uploading a file to the browser is the first step towards opening it. Ideally, there will be no warnings about the file being potentially dangerous, which could prevent a successful download. It is important to understand two key points: the process of downloading a file in a browser does not depend on encryption, and scanning a file with a browser and an antivirus are different processes. There is a check by the browser before the file is downloaded, most noticeable when the file is downloaded and a download indicator is displayed. After downloading, an antivirus scan begins if the corresponding module is activated. Preparing a file to successfully load into a browser requires complex multi-factor steps, including a signature, certificate, cryptographic protection, a clean domain IP address, and hosting. It is important to note that crypting a file and preparing to download it to the browser are different tasks that require an individual approach. A good professional can help with this, but often Google's requirements and policy changes make it difficult. Each problem requires a separate solution; do not confuse everything together.

The difference between "private" and "public" stubs The difference between private and public stubs lies in individuality and limited use. A private stub is created for a specific client, taking into account its requirements and parameters, which ensures a high level of invisibility (FUD=0) when scanning with anti viruses. This type of stub usually has a high rental cost. On the other hand, a public stub is created for a wide range of users and has a limited lifespan. It is often used before mass distribution and may be less reliable. The price of a public stub is usually lower, but its "life" is not predictable. It is important to remember that checking service crypts with live anti viruses can have a negative impact on the crypt, so this method should only be used to assess quality, and not for regular checking.

How to identify services or specialists with whom it is better not to work? 👉 The answer to the question about runtime causes confusion or they state that it is not their responsibility. An adequate service will explain that the creator of the software must monitor the cleanliness of runtime. A high-quality service will help clear runtime if you have a clean build . 👉 Inappropriate behavior and aggression when asked why a supposedly clean crypt is found on a live machine.

Thus, the following aspects are highlighted 👉 Differences between checker results and actual data. If the stability is outdated and has not been updated for a long time, this can significantly distort the picture, depriving the crypto file of its meaning. 👉 Lack of adaptation of the crypt to runtime. If the base file is already suspicious and has many detections at runtime , then what is the point of a perfectly clean scantime crypt? 👉 Low demand for expensive unique stubs. It is important to note that there are adequate services that check cryptocurrencies under Scantime using the method described by me. They test on real machines with antivirus installed manually. However, such services rarely go public.

What is scantime and runtime Scantime is the process of creating a crypt file based on a cryptographic module, which is then converted into a stub, where you can embed any program to obtain the finished file. Scantime is easier to clean and update, but does not take into account the file’s response to startup. Runtime is a process in which a file is launched, the antivirus scans it, and if no danger is detected, the file continues its work. Cleaning runtime is more difficult due to the fact that the process is not related to the crypt and depends on the work of the software creator. Runtime can be static or dynamic. Crypt on scantime and runtime are two different operations that do not intersect with each other. To crypto on Runtime , you need to study antivirus algorithms, scanning methods, find weak points and work around them. This requires a longer process and a unique high-quality crypt. It is important to note that the cleanliness of the base software build plays a key role in successfully cleaning runtime. It is possible to remove several detections on Runtime , but this depends on the purity of the build and the experience of the cryptor.

One thing to do when checking crypto for quality Checking the quality of encryption is the first step. If you have experience or a good understanding in this area, you will understand that it is necessary to check the encrypted file for functionality and ability to bypass security systems, including anti viruses. Checking a file to download can be quick and simple, but checking it to bypass the protection of anti viruses, of which there are many, is a rather complex task. For this purpose, various virus checkers have been created - from the well-known VirusTotal (VT), which makes information available to everyone (which is logical, since this is its task), to other checkers that maintain confidentiality (avcheck, antiscan, kleenscan) BUT very often such services make mistakes and if you want to check the real output of a file you need to get a little confused, namely: We create several virtual machines with the most top-end antiviruses and check whether your encrypted file is detected, and we also check the runtime .

Operating system protection system Operating system protection systems include active and proactive measures. Let's consider all protection systems in detail and sequentially. 1️⃣ Browser File Loading: This is the ability of a file to pass browser inspection without issuing warnings. The file should download and be ready to open without additional alerts. 2️⃣ Static antivirus scan (ScanTime): the antivirus scans the file directly when downloading it in the browser. A good cryptographic approach is required to successfully pass the verification. To download a file safely without problems and warnings, you need to go through 2 protection systems: browser and antivirus. 3️⃣ UAC (User Account Control): Some services can bypass UAC, but this has nothing to do with the request to open a file when downloading from a browser. Bypassing UAC is not necessary. 4️⃣ Dynamic antivirus scanning at startup (RunTime): when a file is launched, the antivirus begins to actively scan it. If the file fails verification, it is blocked. The difference between static and dynamic verification will be discussed later. 5️⃣ SmartScreen: This is a proactive security system that verifies the file's signature and certification. If something is suspicious, SmartScreen asks whether to run the file. To successfully launch the file without problems, you need to go through 2 more protection systems: dynamic antivirus scanning and SmartScreen.

What is a file crypt ? For those who are just starting to understand this topic, an encrypted file is a file that is encrypted to bypass antivirus programs. This is done so that the file appears safe and can be downloaded and run without fear of possible consequences from antivirus software. Typically, the purpose of encryption is to hide and protect information from unwanted access.

Who is this post useful for ? For beginners, to understand the general picture of the crypto world and avoid pitfalls. We posted in Scarletta many posts about botnet, but this is a rare topic. Experienced users who are tired of paying for services that either do not work or work unsatisfactorily.

⌛️ WHAT IS CRYPTING ⌛️ This post examines the concept of a crypt file, as well as the reasons why a large number of crypt services on the market may be impractical and overpriced.