[RCE]

indeed looks like kardon
@El Lobo has a valid point, care to answer any questions on your thread? it does look shady that you're not willing to answer here and prefer somewhere private

Kardon don't have encrypted C&C,inline asm,dropper,watchdog...more ?
The point that the technical issues shouldn't be discussed here because this is a sale thread and El Lobo is not a potential customer to answer his questions btw his questions:

What does mean "Encrypted C&C (RC4)"?
-It means the communication between client and server is encrypted by RC4 algorithm which it generates PRNG.

Do you inject watchdog threads into already running processes? What does it mean aggressive persistence?
-Watchdog will monitor the changing of files/registry keys plus it injects itself into a process to achieve the goal, aggressive persistence means it monitor any changing/modification of its component to perform an instant action (Integrity checker)
How do you achieve hidden startup? By using run once reg key?
-The files and folders that used for startup are hidden , i didn't implement a ring3 rootkit beside the most hooking techniques are detectable by HIPS.
How do you bypass hips? Do you use hook evasion, if yes how? Does your bot use injection or it uses its own process?
-I'vent tested the RT detection, but the most functions are coded to evade some of AV's runtime detection like using random user agents, dynamic connection period, and others will not discuss here.

[El Lobo]

Kardon don't have encrypted C&C,inline asm,dropper,watchdog...more ?
The point that the technical issues shouldn't be discussed here because this is a sale thread and El Lobo is not a potential customer to answer his questions btw his questions:

What does mean "Encrypted C&C (RC4)"?
-It means the communication between client and server is encrypted by RC4 algorithm which it generates PRNG.

Do you inject watchdog threads into already running processes? What does it mean aggressive persistence?
-Watchdog will monitor the changing of files/registry keys plus it injects itself into a process to achieve the goal, aggressive persistence means it monitor any changing/modification of its component to perform an instant action (Integrity checker)
How do you achieve hidden startup? By using run once reg key?
-The files and folders that used for startup are hidden , i didn't implement a ring3 rootkit beside the most hooking techniques are detectable by HIPS.
How do you bypass hips? Do you use hook evasion, if yes how? Does your bot use injection or it uses its own process?
-I'vent tested the RT detection, but the most functions are coded to evade some of AV's runtime detection like using random user agents, dynamic connection period, and others will not discuss here.

I dont want to sound like an asshole but your answers are pretty shit and doesnt explain anything. Whats the use of PRNG? I dont get it? Does RC4 generates PRNG? Do you even know what does PRNG stands for?


How do you inject? What windows apis are you using to perform injection? Do you create a new thread in the process you inject to? How do you write your malware to the proces, using WPM?

How are the files and folder hidden? By using windows default options to hide files and folders? Can they be seen when you enable show hidden files and folders in windows explorer? You say rootkit is detected by all avs but why do you thing that process injection isnt?

Dynamic connection period and random useragent wont do anything in regard to antivirus runtime detection.

[shekel thief]

looking good, keep the thread up to date.

[RCE]

@El Lobo, nothing of my business is 'how' you ask and i reply with a short answer, you will not get what u want so don't try.
I'm not an english user so i couldnt explain i well and i wrote the reply quick without in-depth explanation.

@Zettabit, GTFO with ur .net shit kid.

[exploit.exe]

This is interesting, do you have videos of it?

[3DES]

Provide a bin for reversing if you want to get rid of false claims and clean your reputation atleast.

[RCE]

This is interesting, do you have videos of it?

I'll post a video soon.

---

Provide a bin for reversing if you want to get rid of false claims and clean your reputation atleast.

I think u are the person who need to clean his negative reputation haha

[RCE]

It's too pathetic that beginner malware researchers doing their utmost to get a bin but i like to make them scream more haha .
Creating multiple accounts here and keep asking for questions just to get some info to reverse the loader later and explore its functions,,
well i want to say .. hard luck 🤣

[NotAFed]

"reputation" in this forums means fucking nothing, im talking about your fucking product you are selling, but not providing enough information to buyers in your sales thread. Why do people need to contact you in jabber to get all details, what are you hiding?

The panel looks like a paste, little information is given about the bot, and OP dodges questions that are important to potential buyers such as me. I was quite interested, but after seeing the way OP has presented himself and his product, I think 300 dollars can go into someone elses pocket...

[RCE]

The panel looks like a paste, little information is given about the bot, and OP dodges questions that are important to potential buyers such as me. I was quite interested, but after seeing the way OP has presented himself and his product, I think 300 dollars can go into someone elses pocket...

You seem like a multi, good luck find someone else.

[Twistd]

You know I find it funny how people are hammering pasting. There's nothing wrong with pasting code as long as you know exactly what that code is doing :) i paste old code I've written every day as I cba to rewrite it every time I need it. There's no reason to reinvent the wheel. However if you don't know what the code does and simply pasting, that's when it becomes a problem :)

Also for the record I wouldn't share a sample to reversing just because some people in my thread demanded it either. He could however improve his thread my adding a bit more technical information 😁

[RCE]

You know I find it funny how people are hammering pasting. There's nothing wrong with pasting code as long as you know exactly what that code is doing :) i paste old code I've written every day as I cba to rewrite it every time I need it. There's no reason to reinvent the wheel. However if you don't know what the code does and simply pasting, that's when it becomes a problem :)

Also for the record I wouldn't share a sample to reversing just because some people in my thread demanded it either. He could however improve his thread my adding a bit more technical information 😁

Correct , also i know these fu*kers they are comes from researching groups just to post trash here , they upgrade their rank by posting a new malware sample's and doing some reports, that's why i will not share any important info here ,, i won't make the process for them easy , lets give them some difficulty 😁

[zeros4code]

still reading to know the next action.. best of luck guyz

[El Lobo]

You know I find it funny how people are hammering pasting. There's nothing wrong with pasting code as long as you know exactly what that code is doing :) i paste old code I've written every day as I cba to rewrite it every time I need it. There's no reason to reinvent the wheel. However if you don't know what the code does and simply pasting, that's when it becomes a problem :)

Also for the record I wouldn't share a sample to reversing just because some people in my thread demanded it either. He could however improve his thread my adding a bit more technical information 😁

I have never said anything about copypasting. You probably hasnt reffered to me but I had to write it just in case you were. I just asked him simple questions about his malware. I do not ask for a sample nor anything and from his posts I can clearly see that he has very low knowledege about it. Sure, he managed to send some basic http request and all the basic stuff that goes with it that makes low end malware.

[RCE]

@El Lobo , Who the fuk u think u are to evaluate other people knowledge ? i think u forget ur place kid go back to the cave that u come from however, u will not get what u want.
if you think this is a basic botnet then GTFO and find other thread to trash it.