[NotKover]

This is a thread to show the progress of the loader i soon plan to sell here on HF, if you have any suggestions or requests of what i should add please send them here

---

The current functionality it has right now are:
A:Loader
1.Drop in WD exclusions folder and run
2.Drop in non WD exclusions folder and run
B:Update
C:Startup and persistance
D:UAC exploit
1.Adds install paths to WD exclusion & WD exclusions drop folder
2.Restarts loader with admin(either on startup or after exploit is ran)
E:Very basic botkiller(wont release till deemed ready aka when its the best killer ik of)
F:Communications over HTTP

[Super]

Seems really cool, but I have a couple questions about it.

What does WD exclusions folder mean?
Also, does the UAC bypass work on the latest version of Windows 11, or is it targeting outdated systems?

[NotKover]

Seems really cool, but I have a couple questions about it.

What does WD exclusions folder mean?
Also, does the UAC bypass work on the latest version of Windows 11, or is it targeting outdated systems?

WD exclusions folder is a windows defender exclusions folder where windows defender and a alright handful of other AVs will not scan the selected locations, and my UAC exploit i use works on the newest version of w10 and w11 with nearly every AV, i can send some runtime scans using my uac exploit

Scans using the exploit:
https://checkzilla.io/scan/2319e9a3-69cc...b692e8e7ef
https://checkzilla.io/scan/8b34995d-11f2...f1af453f26
(Some major changes have happened between those scans with my dropper)

---

Also when this is ready for sale ill probably move over to one of my better exploits i have saved away to ensure the best results

[Super]

WD exclusions folder is a windows defender exclusions folder where windows defender and a alright handful of other AVs will not scan the selected locations, and my UAC exploit i use works on the newest version of w10 and w11 with nearly every AV, i can send some runtime scans using my uac exploit

Scans using the exploit:
https://checkzilla.io/scan/2319e9a3-69cc...b692e8e7ef
https://checkzilla.io/scan/8b34995d-11f2...f1af453f26
(Some major changes have happened between those scans with my dropper)

---

Also when this is ready for sale ill probably move over to one of my better exploits i have saved away to ensure the best results

That's amazing you have a working UAC exploit, most of the ones I know about have gotten patched by now.

Seems like it will be a good product, GLWS.

[NotKover]

That's amazing you have a working UAC exploit, most of the ones I know about have gotten patched by now.

Seems like it will be a good product, GLWS.

Thank you very much, if you have any suggestions please let me know because i dont really know what i should and shouldnt add

[TheGate]

Are you going to give any vouchies for this?

[NotKover]

Are you going to give any vouchies for this?

once i think its ready maybe, mainly depends on how well it turns out

[__Digital__]

Good luck with your project, i understand why people are using rust. Because it remains fud longer due to avs not caught with it yet. It just reminds me of the good old autoit binary. but with rust they are 10mb easy. As i said good luck with your project hope it is very successful.

[NotKover]

Good luck with your project, i understand why people are using rust. Because it remains fud longer due to avs not caught with it yet. It just reminds me of the good old autoit binary. but with rust they are 10mb easy. As i said good luck with your project hope it is very successful.

My current binary is only 800KB and has a good handful of functions but once im done the size will probably be like 4MB~ if not more

---

I would love to see how this fares up against HP Wolf Security with dynamic detection. Businesses, banks in the western world have been transitioning workstations to HP infrastructure and subscribing to their dynamic detection modules. Which has proven to be quite good.
A simple subscription costs a proof of business, consultation and about $5k USD/year for a company.
Not to be confused with HP Wolf Essential Security for home/business use included in newer desktops for free.

The past few months I have been researching this myself and confess myself impressed. Even with heavily encrypted remote malware (consistent connection) bypassing ZoneAlarm runtime.

Once its ready we can do some testing with it and see, i was thinking about how it would handle to enterprise AVs so we can find out later

[Xzedin]

As long as you have the basics down then start adding the sought after functions. So far so good. Seen your posts graduate to a higher level in this forum.

[AnonTri]

Thank you very much, if you have any suggestions please let me know because i dont really know what i should and shouldnt add

If it does not already it should allow for loading both exe and dll from disk and memory as well as having multiple fallback c2 servers if not giving it a DGA. Though if it does have DGA please allow for fallback c2 to prevent sinkholing. Other than that good persistence and a stable/secure connection will be your biggest selling points for a loader. Anything that makes it more resilient or more likely to last is worth more than any specific features (in terms of logging or proxies or anything not directly related to a loader)

[NotKover]

If it does not already it should allow for loading both exe and dll from disk and memory as well as having multiple fallback c2 servers if not giving it a DGA. Though if it does have DGA please allow for fallback c2 to prevent sinkholing. Other than that good persistence and a stable/secure connection will be your biggest selling points for a loader. Anything that makes it more resilient or more likely to last is worth more than any specific features (in terms of logging or proxies or anything not directly related to a loader)

These are planned and i have a good handful of "unique" startup and persistence methods i will implement and test to make sure they dont add any detection vectors but it will be awhile before then

[wyvn]

how long have you been coding in Rust for and how effective would you say it is to learn for malware development?

I'm currently looking into learning C++ or C, but Rust seems interesting to me also, I'll be learning from the start so i'd rather get locked in to one, which would you recommend?

[NotKover]

how effective would you say it is to learn for malware development?

It can be very effective but is hard to learn from since there isnt like any examples on any already

I'm currently looking into learning C++ or C, but Rust seems interesting to me also, I'll be learning from the start so i'd rather get locked in to one, which would you recommend?

personally i would go for rust but i would learn c++ or rust

[NotKover]

Little update,
I have been working on a rootkit in rust and have a fully ready and functional userland rootkit and will soon try to work on a kernel level rootkit but will need to do further research into finding a driver to load said kit and wont cause a major detection vector

I have also started to work on a AMSI bypass that is not dependent on powershell and will hopefully have it prepared in the next coming days


If you have any suggestions or requests or questions, feel free to comment here to message me via PM/convo or telegram @NotKover

---

The current binary size is 1.94MB and i will work to reduce the size, i will soon be implementing more complicated functions to then do extensive testing to ensure there is no detection vectors by any of my methods, if you have any suggestions or request, please let me know