Apr 21, 2018 08:48 PM
(This post was last modified: May 23, 2018 09:37 PM by Yattaze.)
This is the continuation / rebrand of the ZeroCool Botnet.
So some of you may remember ZeroCool, the bot I was coding awhile back
now. during the time between me being largely inactive and now I've been held up
with the real world and looking back too the old codebase with new eyes... well it wasn't
good, there was no structure and it looked like it had been thrown together by someone
who thought they knew what they were doing. (Which isn't far from the truth). So, I did
endless amounts of research, combing through leaked sources and other projects, reading
blogs and generally improving my knowledge on the subject... And here we are now, I've spent
the last few weeks planning out and starting a new bot, with a new name.
Please note this is not a sales thread, and there are no vouch copies or anything along those lines,
thought I would get that out of the way as it seemed to be a common question.
Specific Planned Features:
- Panel:
- New Custom Design [DONE]
- Built in bot shop [DONE]
- RC4 Encrypted Communication
- Bot:
- [TASK] Download & Execute [DONE]
- [TASK] Update [DONE]
- [TASK] Uninstall [DONE]
- Usermode Rootkit [DONE]
- RC4 Encryption Library [DONE]
- Debug / Analysis Prevention
- Builtin TOR Support
- Domain Generation Algorithm [DONE]
Panel Pictures:
Index:
![[Image: PeiESIT.png]](https://i.imgur.com/PeiESIT.png)
Clients:
![[Image: 9ppRg1b.png]](https://i.imgur.com/9ppRg1b.png)
Tasks:
![[Image: TtitlwC.png]](https://i.imgur.com/TtitlwC.png)
Store Backend:
![[Image: Hlp2OR5.png]](https://i.imgur.com/Hlp2OR5.png)
Logs:
![[Image: RjIosEL.png]](https://i.imgur.com/RjIosEL.png)
I wasn't advertising discord I was letting people know where they can contact me, dick
Quote:Builtin TOR Support
Domain Generation Algorithm
Why would you have both of these though?
(Apr 21, 2018 08:54 PM)Friedrich Nietzsche Wrote: Why would you have both of these though?
Ones only available if the other is disabled, so you can't have tor and dga
only one or the other
I wasn't advertising discord I was letting people know where they can contact me, dick
This looks absolutely epic, great work - are you planning on doing a beta, paid or otherwise?
(Apr 21, 2018 09:31 PM)MrPatterson Wrote: This looks absolutely epic, great work - are you planning on doing a beta, paid or otherwise?
I am looking into private pre-release testing where 5-10 trusted people can test stability,
bugs, security etc so I can correct potential issues before I officially sell it.
I wasn't advertising discord I was letting people know where they can contact me, dick
Oh nice, its beautiful, epic !
DO NOT DEAL WITH THIS MEMBER
Apr 22, 2018 12:52 AM
(This post was last modified: Apr 22, 2018 12:57 AM by ᵠᴀ̲̅narchistᵠ.)
I can be one of the testers. Which language?
Same, what is this written in?
Hey,
Looking awesome!
Good luck,
IzzyMichiel
I would love to work with you on this, please consider it
DO NOT DEAL WITH THIS MEMBER
If you want a silly DGA idea, something I thought of a couple days ago, maybe use Trump's first tweet of the current week as a seed for your DGA.
Very unpredictable, but a bit of a race condition against security researchers though.
In regards to your "Usermode Rootkit", is this hiding the process or hooking for terminate/open handle?
Good luck with development.
(Apr 22, 2018 02:37 AM)DeletedUser999213 Wrote: I would love to work with you on this, please consider it damn this looks amazing, good luck and would love to see updates on the status of this, if you need any help let me know. Also i hella vouch for TH3FR3D he is a good coder and would love to see some of his code with this aswell.
Keep up the good work!
:D
Apr 22, 2018 03:18 AM
(This post was last modified: Apr 22, 2018 03:20 AM by Yattaze.)
(Apr 22, 2018 12:52 AM)ᵠᴀ̲̅narchistᵠ Wrote: I can be one of the testers. Which language?
(Apr 22, 2018 01:43 AM)inyourmemory Wrote: Same, what is this written in?
(Apr 22, 2018 02:37 AM)DeletedUser999213 Wrote: I would love to work with you on this, please consider it
(Apr 22, 2018 03:02 AM)05317832892 Wrote: If you want a silly DGA idea, something I thought of a couple days ago, maybe use Trump's first tweet of the current week as a seed for your DGA.
Very unpredictable, but a bit of a race condition against security researchers though.
In regards to your "Usermode Rootkit", is this hiding the process or hooking for terminate/open handle?
Good luck with development.
Thank you all for the interest and I will look into testers when its closer to a releasable state.
In regards to the language, the bot is written in C++11, with a custom CRT and the rootkit is
C++11 Both statically linked supporting XP Sp1 upwards and currently, the rootkit is hiding
the process and any dropped files, I'm also looking into hiding any registry keys it will use
I wasn't advertising discord I was letting people know where they can contact me, dick
DO NOT DEAL WITH THIS MEMBER
(Apr 22, 2018 03:18 AM)Yattaze Wrote: Thank you all for the interest and I will look into testers when its closer to a releasable state.
In regards to the language, the bot is written in C++11, with a custom CRT and the rootkit is
C++11 Both statically linked supporting XP Sp1 upwards and currently, the rootkit is hiding
the process and any dropped files, I'm also looking into hiding any registry keys it will use
ZwCreateFile
NtOpenFile
ZwQueryDirectoryFile
NtEnumerateValueKey
RtlGetNativeSystemInformation
NtSetValueKey
ZwDeleteValueKey
ZwQueryValueKey
NtOpenProcess
Those are the ones hooked my kronos, they will do the job well.
(Apr 22, 2018 03:24 AM)05317832892 Wrote: ZwCreateFile
NtOpenFile
ZwQueryDirectoryFile
NtEnumerateValueKey
RtlGetNativeSystemInformation
NtSetValueKey
ZwDeleteValueKey
ZwQueryValueKey
NtOpenProcess
Those are the ones hooked my kronos, they will do the job well.
Thanks for this, it'll add them to my Todo list and do my research
I wasn't advertising discord I was letting people know where they can contact me, dick
|
