![]() |
|
[.NET] 16kb Botkiller + dropper Fud - Printable Version +- Hack Forums (https://hackforums.net) +-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444) +--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151) +---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118) +---- Thread: [.NET] 16kb Botkiller + dropper Fud (/showthread.php?tid=5450676) |
16kb Botkiller + dropper Fud - LeTippiie - Oct 31, 2016 Here's my source to my Botkiller and dropper bin Change "google.com/f.exe" to your RAT/BOT link and compile enjoy here is a scan of a bin nodistribute.com/result/pzB6qE9A0HYd8UkuOLQyJ3oTitjf Code Imports System.Text* - Alison Wonderland - Nov 1, 2016 SO kill and kill all process in the startup of registry that are found in temp or app data? and remove the key? Nothing with startup folder? Nothing for Fileless virus' that use only registry to run? and this will almost definitley trigger every runtime AV's detections * - LeTippiie - Nov 1, 2016 (Nov 1, 2016 12:04 AM)Alison Wonderland Wrote: SO kill and kill all process in the startup of registry that are found in temp or app data? Runtime avs actually don't pick it up and if you want a snippet on removing bots in start up folder i can write it ifyou really need it along with your "fileless" files running off of registry i never said it was an ace botkiller im sorry i have failed you oh great one * - Alison Wonderland - Nov 1, 2016 (Nov 1, 2016 12:16 AM)LeTippiie Wrote: Runtime avs actually don't pick it up and if you want a snippet on removing bots in start up folder i can write it ifyou really need it along with your "fileless" files running off of registry Im actually good. Was just pointing out flaws in case anyone wanted to use this a basis its okay but to know limitations is good also yknow. Filesless virus, not filesless files. Yknow ones that use encrypted registry keys that run commands that run PS via commandline to execute payload from memory? those ones * - LeTippiie - Nov 1, 2016 (Nov 1, 2016 12:19 AM)Alison Wonderland Wrote: Im actually good. Was just pointing out flaws in case anyone wanted to use this a basis its okay but to know limitations is good also yknow. I understand where your coming from and I admit the limitations of it and your right if you execute from reg it will have no effect but if amyone needs help adding the function to do so I will provide and example if need be not trying to fight just releasing some of my older work for others to gain a bit of understanding so that they can apply to projects of there own |