Hack Forums
IM 4.5 Module Protection | Question?! - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Remote Administration Tools (https://hackforums.net/forumdisplay.php?fid=114)
+---- Thread: IM 4.5 Module Protection | Question?! (/showthread.php?tid=5425281)

IM 4.5 Module Protection | Question?! - BTC Bro - Oct 5, 2016

Hello all,

I have been a way for a while but I am back now (:
Anyway lemme get to the point, I see Imminent Monitor finally got a update which is great! But I also see there are some new settings in the "Module Protection" I will show you below.

[Image: YJdiN1C.png]

I hope somebody here could explain me what all of these settings are and what they do and what you should use and should not use!
I will write them down for you so you can just copy paste it! xD

File Integration
Hide File
Startup Watcher
Disable Taskmanager
Process Security
Citical Process
Process Watcher

Hope somebody is kind enough to explain it to me, thanks in advance!

BTC Bro

* - bzrΚ - Oct 5, 2016

File Integration
Honestly not sure.
Hide File
Hides the file from view.
Startup Watcher
Secondary task to ensure startup isn't deleted.
Disable Taskmanager
Self explanatory.
Process Security
Persistence.
Citical Process
BSOD on process termination.
Process Watcher
Second process to watch the original process.

I'm fairly certain they are correct - if anyone disagrees with this please correct me.

* - Autist - Oct 5, 2016

File Integration I belive is melt (deletes file after running)

* - BTC Bro - Oct 5, 2016

Thanks guys! Kinda what I thought already wanted to be sure.
Didn't know about Citical Process and Process Watcher though.

* - SIM-297877 - Oct 5, 2016

You should never disable task manger, that makes it hella suspicious. Unless they mean using a userkit to hide it from the list.

* - Rhez - Oct 6, 2016

(Oct 5, 2016 06:24 PM)BTC Bro Wrote:  Thanks guys! Kinda what I thought already wanted to be sure.
Didn't know about Citical Process and Process Watcher though.

Critical Process. If your client has been closed then it will cause BSOD.
Process Watcher. It's for persistence.

* - Purple Kief - Oct 6, 2016

(Oct 5, 2016 06:05 PM)BTC Bro Wrote:  File Integration
Hide File
Startup Watcher
Disable Taskmanager
Process Security
Citical Process
Process Watcher
File Integration: A feature known as 'melt' where your file deletes itself upon execution.

Hide File: Hides file from view, think it only works for people that can't see invisible folders.

Startup Watcher: Keeps an eye on the startup keys.

Disable Taskmanager: Launches nukes at Russia.

Process Security: Standart persistence.

Citical Process: Generates a BSOD when process gets killed. (requires admin)

Process Watcher: Seperate process that'll keep an eye on the original process. EDIT: Not a seperate process, a DLL is injected into multiple processes that watches the original.

Did you know?: Shockwave was originally going to keep tooltips explaining that when hovering over text. He forgot cause he's a panda. Blame Shock for this. 😁
PS: We also have a ticket site where you can ask all of this. ;) http://help.imminentmethods.net