+- Hack Forums (https://hackforums.net)
+-- Forum: Marketplace (https://hackforums.net/forumdisplay.php?fid=105)
+--- Forum: Bazaar (https://hackforums.net/forumdisplay.php?fid=450)
+---- Forum: Marketplace Discussions (https://hackforums.net/forumdisplay.php?fid=163)
+---- Thread: Rombertik V2.0 - FormGrabber Development Thread (/showthread.php?tid=5239015)
Rombertik V2.0 - FormGrabber Development Thread - TERRORISST---- - Apr 15, 2016
Rombertik V2.0 Features
-HTTP 2.0/SPDY Support for TLS & HTTP / 1.1 & QUIC
-Decompresses HTTP / 2.0 & SPDY Headers
-Decrypts QUIC payload
-Rootkit that injects into x64 & x86 without drops
-Will have setting to load unsigned driver by using vulnerable VirtualBox Driver, or by modifying boot settings (Test signing & watermark removed) This driver will register callbacks for specific process handles to protect from the kernel. We will also scan signatures during process creation, also disable any .net application from running on the PC.
-Thread safe dispatch routines, aka no crashes
Browsers that will be included:
-FireFox
-Chrome
-Chromium
-Internet Explorer
Possible Protocols System - Wide Injection (x86 & x64):
-POP3
-FTP
We do not condone in using terminology such as:
-Balloon executable
-Lagos Island rootkit
Which are terms made by incompetent coders to attract customers.
I will need reviewers, post here if you are experienced with malware.
XMPP: [email protected]