zw0scura | Dropper | Stub size 4Kb | API Encryption | native C++ Stub

zw0scura | Dropper | Stub size 4Kb | API Encryption | native C++ Stub | Free - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Hacking Tools and Programs (https://hackforums.net/forumdisplay.php?fid=10)
+---- Thread: zw0scura | Dropper | Stub size 4Kb | API Encryption | native C++ Stub | Free (/showthread.php?tid=4706744)

I have started a little Project for my self just a simple Dropper, only for Download and Execute a File. The Stub is coded in C++ and some inline ASM, i also include an API Encryption (CallApibyName), the API strings are encrypted with a simple XOR, also i have a Section encryption included there also use XOR for encrypt and decrypt the code. In the Stub are 2 main Sections .Stub and .Code, in the .Stub is the decrypt routine, this decrypt the .Code Section with an XOR Key from the resources at runtime. In the .Code Section is the Download Thread this loads the settings like URL, Filename, CmdArgs from the resources and download the File from the URL with InternetReadFile and saves it to the User temp Folder and run it after with ShellExecute. The Stub dont need the a Visual C++ Runtime Lib its coded in native C++ and the size its only 4,5Kb with the settings !!!

The Builder was created with C# and only encrypt the .Code Section of the Stub and add the settings to the resources of the Stub.

Screenshot of the Builder:
[Image: L8m9lqR.png]

Yes, I know that the Dropper dont have many functions, for now its just a little Project, when some people like it i would add some function here a list of the possible functions

UAC Bypass
RunPE
Multi File Download
Binder
PE Injector (to Inject the Dropper in a other PE File)
Other Encryption
Save the Config in a Section instead resources
Icon Changer
Assembly Changer

This is just a list of function that I can add in the future when someone like it. When someone have an idea to a function that i should add please Post below or PM me.

I dont have tested this many, so when someone have a problem please pm me.

Builder Scan Result:
Spoiler (Click to View)

For the Download link please PM me!

* - 2iceofficial - May 23, 2016

Please a download will do alot of help thanks!

* - gravitex - Sep 3, 2016

hm, this seems like is has alot of potential!

good luck :)

* - bloodh00t1 - Oct 17, 2016

look great mate goinn the right way

* - arne543 - Nov 9, 2016

could i get the link pls :)

* - LanMan - Nov 10, 2016

Funny i just finished almost the same project as you. ASM payload into a C host, hidden winapi call and hooking Sleep to call the decrypted payload. ✌

Currently 763bytes for the full exe with url, and 0/56 👹
Trying to reduce it even more without corrupting the PE format

Edit: Oops should have looked at the dates before posting.