![]() |
|
[.NET] [VB.NET] Persistence Class - File\Process\Registry [Source] - Printable Version +- Hack Forums (https://hackforums.net) +-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444) +--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151) +---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118) +---- Thread: [.NET] [VB.NET] Persistence Class - File\Process\Registry [Source] (/showthread.php?tid=2153077) Pages: Pages
1
2
|
[VB.NET] Persistence Class - File\Process\Registry [Source] - [ ZERO ] - Jan 27, 2012 Hey guys, again I'm sharing something useful for you. This is my persistence class that can be used with keyloggers\crypters\RATs, and everything else where you need it. It's using threads, and not stupid timers, and it monitors file\process\registry activity, making your file unkillable. Also, I've added a disable feature that is really noob like, but I was lazy to make something more complicated. You can cancel persistence by making a file named "stop.txt" in the same directory where your file is. Easy as that.. Enjoy using it, and don't forget the credits. Demonstration : Source : Code Public Class PersistenceCall it like this : Code Dim CallPer As New Persistence("File1", "File2", "Mutex1", "Mutex2")* - fillobotto - Jan 27, 2012 Mutex? :S Can you write here a little explanation? * - [ ZERO ] - Jan 27, 2012 (Jan 27, 2012 03:11 PM)fillobotto Wrote: Mutex? :S Here you go, you can read it here : http://en.wikipedia.org/wiki/Mutex * - N3oNight - Jan 27, 2012 Grate share Zero.. nice to see something again from you. * - fillobotto - Jan 27, 2012 I read it in Italian xD To be honest I understood what it is, but I still wondering how to get it from a process * - [ ZERO ] - Jan 27, 2012 (Jan 27, 2012 03:14 PM)N3oNight Wrote: Grate share Zero.. Thanks mate, I appreciate it. I'll be posting more useful classes\snippets as soon as I get some free time. =) (Jan 27, 2012 03:15 PM)fillobotto Wrote: I read it in Italian xD You don't have to get it from a process. Simply, when calling persistence class, use any name for Mutex1 & Mutex2, but make sure that they're unique. Example : "ioasjdoiahsd" & "UIASDH86Y" * - Support. - Jan 27, 2012 Great share dude, really is, Shame skids will still post threads asking for it, lol. I can't rep obv. (I would) but I'll say it here, I think your a brilliant coder & a big name in the HF VB section. Off topic, would you be willing to sell the source to the injection app application you made? I'm not planning to resell/leech/rip/release any of it at! I've bin learning mono.cecil for the past few months now & I would pay to see how you translated code & also how you protected the app itself. * - Unkn0wn X - Jan 27, 2012 Grate tutorial buddy.. But i may say this Start-up is detected.. You can just use to Copy exe to start-up under a while loop.. So it will be start-up + persistence too if you just put thread sleep with it.. * - iRtehLeet™ - Jan 27, 2012 Great share ZERO, it's all put together very nicely, great job on it. Just wondering, does using System.IO.File.Copy trigger any runtime detections even if the file is FUD? (Jan 27, 2012 03:50 PM)"XxX Wrote: But i may say this Start-up is detected.. How is putting a file in the Microsoft/Windows/CurrentVer/Run detected? * - Support. - Jan 27, 2012 (Jan 27, 2012 03:57 PM)iRtehLeet™ Wrote: Great share ZERO, it's all put together very nicely, great job on it. I've used System.IO.File.Copy in many apps and many have been FUD. (Non-Malious anyway) but I think they probably detect System.IO.File.Copy("winlogon.exe") just for the fact as it seems obv. * - Coding4Noobs - Jan 27, 2012 so you made a loader :/ which if you have a second application in the resources, isnt it gunna increase the file size a lot :/... then again you could compile the loader at runtime instead which will decrease the size a bit * - [ ZERO ] - Jan 27, 2012 (Jan 27, 2012 04:34 PM)scriptkiddy Wrote: I like how you call timers crappy when your project is laughable and shouldn't even be considered Persistence. You clearly don't know what timers are and you aren't even checking for file modifications or using events. Another copy pasta skid, good copy paste release. It's called persistence because it is persistent on the computer where it's active. Let me explain it to you, since I see that your capability of understanding simple things is poor. I will translate the definition of my class's capabilities to your language. Normal : Code With this class, you cannot terminate a running process, which file is protected by this class. Also, You cannot delete it, or modify it's registry startup.Your language : Code Thiz toolz not dont use TimErS, And ITs shit, I know you know timers, and C-+ and you finDZ thiz claz not usable, because YoU know moar stuff than everybody else.Therefore to avoid further discussion with you, your post is going to be reported for low quality and you will receive negative reputation if you consider to post another low quality reply on this thread. Have a good day, ~ZERO P.S. Answer to all who asked, if something is detected : Well, I didn't really check detection, but I believe that File.Copy is detected, and the registry part is probably detected also, so I recommend to slightly modify code in order to bypass those detections. (Jan 27, 2012 04:32 PM)Coding4Noobs Wrote: so you made a loader :/ which if you have a second application in the resources, isnt it gunna increase the file size a lot :/... then again you could compile the loader at runtime instead which will decrease the size a bit Well, I don't really mind about the file size, since it's all being processed at the local hard drive, size would matter if you would download a file from the web, or I don't know share it like that, if you know what I mean. To put it simple, I find it better to use one class for this, instead of using a compiler to compile a file that will do the exact same thing. * - nathan72389 - Jan 27, 2012 man, there is alot wrong with your class. if i make a blank form and close it the process will still stay running because of your loops. the app does not restart, the code does not restart, its just your classes thread that is keeping the process alive. from there i can still close it through taskmanager simply by "end process". i thought that i would atleast have to suspend the process, then kill it, but that wasent even the thing to do. maybe i missed something. * - [ ZERO ] - Jan 27, 2012 Well, I'm using this class for CodeDOM generated files, aka Console Applications. Also, that video that is in the thread, is with a console application, try with one of those, and you'll see that it'll work. I never intended to use it with forms. * - GhxTeam - Aug 10, 2017 i am gonnatry to use it on mycrypter ty |