Hack Forums
[HTTP] Kardon Loader - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Marketplace (https://hackforums.net/forumdisplay.php?fid=105)
+--- Forum: Bazaar (https://hackforums.net/forumdisplay.php?fid=450)
+---- Forum: Marketplace Discussions (https://hackforums.net/forumdisplay.php?fid=163)
+---- Thread: [HTTP] Kardon Loader (/showthread.php?tid=5828006)

Pages: Pages 1 2 3 4 5 6 7 8 9

[HTTP] Kardon Loader - Yattaze - Apr 21, 2018

This is the continuation / rebrand of the ZeroCool Botnet.


Sales Open


So some of you may remember ZeroCool, the bot I was coding awhile back
now. during the time between me being largely inactive and now I've been held up
with the real world and looking back too the old codebase with new eyes... well it wasn't
good, there was no structure and it looked like it had been thrown together by someone
who thought they knew what they were doing. (Which isn't far from the truth). So, I did
endless amounts of research, combing through leaked sources and other projects, reading
blogs and generally improving my knowledge on the subject... And here we are now, I've spent
the last few weeks planning out and starting a new bot, with a new name.


Please note this is not a sales thread, and there are no vouch copies or anything along those lines,
thought I would get that out of the way as it seemed to be a common question.

Specific Planned Features:
  1. Panel:
    • New Custom Design [DONE]

    • Built in bot shop [DONE]    

    • RC4 Encrypted Communication



  2. Bot:
    • [TASK] Download & Execute [DONE]

    • [TASK] Update [DONE]

    • [TASK] Uninstall [DONE]

    • Usermode Rootkit [DONE]

    • RC4 Encryption Library [DONE]

    • Debug / Analysis Prevention

    • Builtin TOR Support

    • Domain Generation Algorithm [DONE]




Panel Pictures:
Index:
Spoiler (Click to View)
Clients:
Spoiler (Click to View)
Tasks:
Spoiler (Click to View)
Store Backend:
Spoiler (Click to View)
Logs:
Spoiler (Click to View)

RE: [HTTP] Kardon Loader - Friedrich Nietzsche - Apr 21, 2018

Quote:Builtin TOR Support
Domain Generation Algorithm


Why would you have both of these though?

RE: [HTTP] Kardon Loader - Yattaze - Apr 21, 2018

(Apr 21, 2018 08:54 PM)Friedrich Nietzsche Wrote:  Why would you have both of these though?

Ones only available if the other is disabled, so you can't have tor and dga
only one or the other

RE: [HTTP] Kardon Loader - MrPatterson - Apr 21, 2018

This looks absolutely epic, great work - are you planning on doing a beta, paid or otherwise?

RE: [HTTP] Kardon Loader - Yattaze - Apr 21, 2018

(Apr 21, 2018 09:31 PM)MrPatterson Wrote:  This looks absolutely epic, great work  - are you planning on doing a beta, paid or otherwise?

I am looking into private pre-release testing where 5-10 trusted people can test stability,
bugs, security etc so I can correct potential issues before I officially sell it.

RE: [HTTP] Kardon Loader - INML - Apr 22, 2018

Oh nice, its beautiful, epic !

RE: [HTTP] Kardon Loader - ᵠᴀ̲̅narchistᵠ - Apr 22, 2018

I can be one of the testers. Which language?

RE: [HTTP] Kardon Loader - inyourmemory - Apr 22, 2018

Same, what is this written in?

RE: [HTTP] Kardon Loader - IzzyMichiel - Apr 22, 2018

Hey,

Looking awesome!

Good luck,
IzzyMichiel

RE: [HTTP] Kardon Loader - DeletedUser999213 - Apr 22, 2018

I would love to work with you on this, please consider it

RE: [HTTP] Kardon Loader - 05317832892 - Apr 22, 2018

If you want a silly DGA idea, something I thought of a couple days ago, maybe use Trump's first tweet of the current week as a seed for your DGA.

Very unpredictable, but a bit of a race condition against security researchers though.

In regards to your "Usermode Rootkit", is this hiding the process or hooking for terminate/open handle?

Good luck with development.

RE: [HTTP] Kardon Loader - Nenny - Apr 22, 2018

(Apr 22, 2018 02:37 AM)TH3FR3D Wrote:  I would love to work with you on this, please consider it
damn this looks amazing, good luck and would love to see updates on the status of this, if you need any help let me know. Also i hella vouch for TH3FR3D he is a good coder and would love to see some of his code with this aswell.
Keep up the good work!
:D

RE: [HTTP] Kardon Loader - Yattaze - Apr 22, 2018

(Apr 22, 2018 12:52 AM)kropotkin Wrote:  I can be one of the testers. Which language?

(Apr 22, 2018 01:43 AM)Win64Worm Wrote:  Same, what is this written in?

(Apr 22, 2018 02:37 AM)TH3FR3D Wrote:  I would love to work with you on this, please consider it

(Apr 22, 2018 03:02 AM)ʀᴏᴏᴛᴇᴅ Wrote:  If you want a silly DGA idea, something I thought of a couple days ago, maybe use Trump's first tweet of the current week as a seed for your DGA.

Very unpredictable, but a bit of a race condition against security researchers though.

In regards to your "Usermode Rootkit", is this hiding the process or hooking for terminate/open handle?

Good luck with development.

Thank you all for the interest and I will look into testers when its closer to a releasable state.
In regards to the language, the bot is written in C++11, with a custom CRT and the rootkit is
C++11 Both statically linked supporting XP Sp1 upwards and currently, the rootkit is hiding
the process and any dropped files, I'm also looking into hiding any registry keys it will use

RE: [HTTP] Kardon Loader - 05317832892 - Apr 22, 2018

(Apr 22, 2018 03:18 AM)Yattaze Wrote:  Thank you all for the interest and I will look into testers when its closer to a releasable state.
In regards to the language, the bot is written in C++11, with a custom CRT and the rootkit is
C++11 Both statically linked supporting XP Sp1 upwards and currently, the rootkit is hiding
the process and any dropped files, I'm also looking into hiding any registry keys it will use

ZwCreateFile
NtOpenFile
ZwQueryDirectoryFile
NtEnumerateValueKey
RtlGetNativeSystemInformation
NtSetValueKey
ZwDeleteValueKey
ZwQueryValueKey
NtOpenProcess

Those are the ones hooked my kronos, they will do the job well.

RE: [HTTP] Kardon Loader - Yattaze - Apr 22, 2018

(Apr 22, 2018 03:24 AM)ʀᴏᴏᴛᴇᴅ Wrote:  ZwCreateFile
NtOpenFile
ZwQueryDirectoryFile
NtEnumerateValueKey
RtlGetNativeSystemInformation
NtSetValueKey
ZwDeleteValueKey
ZwQueryValueKey
NtOpenProcess

Those are the ones hooked my kronos, they will do the job well.

Thanks for this, it'll add them to my Todo list and do my research