The update is already finished as I said above, it includes Ring3 Rootkit, Persistence and other things that I would be detailing when I post it. Backing up the C&C is good idea really.
How would you be achieving persistence? I hope so you don't use the ZwFunctions and brand it as "persistence" as the rest of the "coders" here tend to do. Do you intend to add a watchdog/monitor process?
Backup C&C is useful and pretty simple to get functional - both of us know it wouldn't be hard to get that added.
Do you intend to use the Native WinAPI to go with the rootkit?
Please don't hook "NtQueryWindowsSystemInformation" /sarcasm
You could also hook fastsyscall and NtFunctions to achieve the rootkit, ring3 is enough for a free botnet.
UAC bypass - Well I know it would be great and it would be easy to add it. Yes I know, the ones used by Dridex and other, reconstructed by EP.
Its pretty easy if you're intending to add the Social Engineer type method; wouldn't take a few seconds for that.
But if you're moving forward for a real exploit - simply writing/storing the DLL in a secure location would not work though, you would have to include proper process elevation, store your executable in a secure location (comparatively easy), and it must be signed by "Microsoft" for all to be completed.
You could go along with epathobj; since its freely available and this botnet is also freeware.
