20 replies to this topic

[NiTrOwow]

•Credits: me, ZeR0/0cm4n icon & clone module and un4seen for Bass lib and vb wrapper
•Date: 22-12-2012
•Purpose: Clone file header information, change icon, filepumper. Cloning files

Note: cloning filesize of exe does only work with PE's that are bigger in size than the selected PE that you want to change.
Size must me below 2MB. Icons are fine in a lot of sizes. 32x32 up to 256x256 i believe.

Attached Files

•  HackHound.org PE Toolkit v0.1 SRC.rar   4.87MB  127 downloads

[Dante]

That's f~€\%g awesome.
Promise to take a look at it.

[http-nuke]

damn nice one bro
+ the hole code is well organized

[NiTrOwow]

damn nice one bro
+ the hole code is well organized

Could be better but i dont care the stuff works, haha..
I also released the source to prevent people from saying OMG it is detected as a Tr.Dropper.vb.Gen !?! Because it opens a binary file and adds lots if nulls at eof etc.. it also drops bass lib and the xm music file @ app path. Because i don't want to drop shit in %temp% or something else so people dont think it is backdoored.

[http-nuke]

heheheh
but good point, but i think whos gonna be looking for these type of source codes, must know something about it... dropping files, false alarms...etc.

[NiTrOwow]

heheheh
but good point, but i think whos gonna be looking for these type of source codes, must know something about it... dropping files, false alarms...etc.

Nah kids download them and they get a warning from their anti-virus engine. Trojan dropper found. And the other things that happen after that are clear..

[http-nuke]

heh your right
just like this one

Please Login or Register to see this Hidden Content

after uploading the source files >> detected,detected,detected,detected...thanks for explaining anyway

[NiTrOwow]

heh your right
just like this one

Please Login or Register to see this Hidden Content

after uploading the source files >> detected,detected,detected,detected...thanks for explaining anyway

Yup. Thats what i mean. And if they can't even compile it than its their problem.

[Hess]

Good thing indeed , compiled by myself and it's okay. One good thing: The bigger source - smaller executable !

[Hess]

I haven't seen file cloner for a long time , as for kids , it is impossible to get rid of them. Also %temp% could make even let's say average users to start thinking about backdoor inside , so app path is best solution.

[NiTrOwow]

I haven't seen file cloner for a long time , as for kids , it is impossible to get rid of them. Also %temp% could make even let's say average users to start thinking about backdoor inside , so app path is best solution.

Indeed that's why i used app.path. So that it wont look suspicious to people.

[d3m]

What a pity that code is on VB, i leave this lng a long time ago =)

Let's rewrite it to pascal\cpp and it must be opensource.

[Hess]

Embarcadero Delphi XE.x and Visual C++ could be a good solution ?

[d3m]

Hess

Even delphi 7 and VC6++ will be a good solution...

[NiTrOwow]

Hess
Even delphi 7 and VC6++ will be a good solution...

Indeed. I think i will try VC6+ some time. I mean you can do much more with it than crappy VB6.

[d3m]

Anyway in delphi it can be done too... with more abilities

[NiTrOwow]

Anyway in delphi it can be done too... with more abilities

Anyway in delphi it can be done too... with more abilities

I didn't know. Really never tried delphi. I want to learn C++ first and than i'll look intro delphi etc.
Because VB6 is limited till the bone.

[Hess]

I did , I learned Pascal in highschool and Pascal is actually core of Delphi. But , there is one stupid thing , I can not get rid of Delphi runtimes from code and executable , from 8.2 kb source , I got 1.58 mb exe. :S If I could obtain somewhere old Pascal compiler , Delphi part will be pruned and exe will be even smaller than source code. :S

[Ravage]

1.5Mb???
What compiler are you using?

[Mephisto]

Do some googling, there was something like Delphi 2007 Express Edition or something, where the Express removed the Classes.pas and Windows.pas or something.

 

Anyway 1.5MB is quite a lot, I got around 500kB at least. What Libs are you using? try to minimize the usage of "use".

Read what dynamic importing using GetProcAddress is. Static Importing will do the Trick to, however.

Try to exclude Windows.pas and simply copy out the defines and then load only the neccessary things by "import 'user32.dll'", I don't remember the exact syntax, tho.

Also the Classes is nice to have TMemoryStream etc, but if it is for Malware Coding: Copy it out, Do it your own or use Array of Byte.