Hack Forums
Voodoo HTTP | C++ Loader with a Ring 3 Rootkit - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Marketplace (https://hackforums.net/forumdisplay.php?fid=105)
+--- Forum: Premium (https://hackforums.net/forumdisplay.php?fid=451)
+---- Forum: Premium Sellers Section (https://hackforums.net/forumdisplay.php?fid=107)
+---- Thread: Voodoo HTTP | C++ Loader with a Ring 3 Rootkit (/showthread.php?tid=4985221)

Pages: Pages 1 2

Voodoo HTTP | C++ Loader with a Ring 3 Rootkit - Sanch - Sep 12, 2015

Voodoo HTTP

So I have finally recoded my bot!
Voodoo HTTP is a loader written in C++ it will run on Windows 2000 to Windows 10.
It's main feature is a ring 3 rootkit meaning that is totally hidden from most software!
It has been thoroughly tested and is proven to be very stable with thousands of bots.



Features:
  • Small 45 KB stub size

  • Basic commands
    • Download and execute

    • CMD Command

    • Exit

    • Remove / Update



  • Ring 3 x86/x64 rootkit (Injection in a system process and hidden registry key even in safe mode)

  • Runtime FUD

  • Prevent auto sleep and hibernate

  • Obfuscated communication

  • Basic Persistence

  • Clean and functional panel

  • Multiple domain support

  • Function calls and strings are obfuscated





Panel Screenshots:

http://vgy.me/KdDDPn.png
http://vgy.me/SnWqZt.png
http://vgy.me/U0dL8D.png

The panel is not obfuscated and I encourage you to modify it.



Price:

$100 BTC.
Add [email protected] on Jabber or neojesus2 on skype or PM me if you want to buy or test!

* - ๖ۣۜCyber - Sep 12, 2015

Vouch for sanch, one of the best coders on HF.

* - Sanch - Sep 12, 2015

(Sep 12, 2015 01:48 PM)๖ۣۜCyber Wrote:  Vouch for sanch, one of the best coders on HF.

Thank you for the vouch as for me being one of the best coders on HF I doubt it.

* - Netwxrk - Sep 12, 2015

Vouch for Sanch, his HTTP Bot works like a charm.

Spoiler (Click to View)

* - Sanch - Sep 12, 2015

(Sep 12, 2015 02:02 PM)Netwxrk Wrote:  Vouch for Sanch, his HTTP Bot works like a charm.

Spoiler (Click to View)

Thank you for the vouch <3

* - The Sly - Sep 12, 2015

Big Vouch for Sanch, this is 1 of the few ppl here on HF who actually know their shit and arent just reselling other ppls stuff.
Ive seen it in Action and that is some truly amazing botnet, u wont regret investing in it

* - Cibor - Sep 12, 2015

Looks good, good luck with sales

* - r00tard - Sep 12, 2015

No price? If ur giving away send me a pm

* - Sanch - Sep 13, 2015

I love people who down vote this without even commenting! I would love some criticism it might help me improve it :)

* - Sanch - Sep 13, 2015

(Sep 13, 2015 03:55 AM)Pajser Wrote:  Here we go.
Do you use DLL injection that dan wrote?
I really hope that you dont use NT native api to create null terminated reg key and calling it a rootkit?
In what process do you inject your dlls. Explorer?

The stub is quite large for only those function.

I offered you to beta test this you even sent me a PM and I told you to add me on jabber. But no I don't use dll injection. As for the stub size: compile a Hello World in any version of visual studio that is > 7.0 and it will be at least 50 KB if you look at my todo I say compile with vs 6.0.

* - Sanch - Sep 13, 2015

(Sep 13, 2015 04:13 AM)Pajser Wrote:  I have sent you a PM but I haven't received any response from you so I figured that you have found enough beta testers.

As for compiling, ofc the hello world will be 50kb when you use CRT functions like printf etc.

What about persistence, how is it achieved? How does your ring3 rootkit works exactly?


I have sent you a PM but I haven't received any response from you so I figured that you have found enough beta testers.

As for compiling, ofc the hello world will be 50kb when you use CRT functions like printf etc.

What about persistence, how is it achieved? How does your ring3 rootkit works exactly?

I sent you a PM but even without the CRT you will get at least 50 kb if statically link. Look at the feature list I inject into a system process and I have a hidden registry key.

* - Mr. Dr. Prof. Patrick - Sep 13, 2015

(Sep 13, 2015 04:01 AM)Sanch Wrote:  I offered you to beta test this you even sent me a PM and I told you to add me on jabber. But no I don't use dll injection. As for the stub size: compile a Hello World in any version of visual studio that is > 7.0 and it will be at least 50 KB if you look at my todo I say compile with vs 6.0.

If VS is spiting out Big files then just take things into your own hand compile from the CMD line(or pragma), and change your entry point from main or winmain they both come with overheads

* - Sanch - Sep 13, 2015

(Sep 13, 2015 05:00 AM)Mr. Dr. Prof. Patrick Wrote:  If VS is spiting out Big files then just take things into your own hand compile from the CMD line(or pragma), and change your entry point from main or winmain they both come with overheads

When I will compile with VS 6 the size will be 1/3 of what it is now.

* - Darksidefox - Sep 13, 2015

I received a Beta Tester copy, here a short review about the bot:
[+] The installation is pretty simple and you can setup the bot very fast
[+] Bot is simple, no junk functions that increase the file size
[+] The panel looks nice, is smooth and pretty fast. I had no problems
[+] The bot has a Ring 3 Rootkit, which is great for a stable bot with a lot of bots
[+] Bot receives a plugin system
[+] Panel isn't obfuscated, can be extended
[+] Commands work good and don't have a delay of a few minutes
[-] Had a little problem with the CMD Command Task

Overall: Nice bot and thanks for giving me a copy. Keep up the good work! :p

Screenshots:
Spoiler (Click to View)

* - NightAng3L - Sep 13, 2015

1 - Does the rootkit work on 64 bit ?
2 - Rootkit able to inject and hook 64 bit process ?
3 - Loader drop's any files on hard disk ?
(One of my friend needs to buy this and he cant post here so i'm asking on behalf of him)
good luck with sales