Pavlo Khazov 82033c21d5 Agent and BeaconC have new injection capabilities. ...

"inject" - writes shellcode into process, which can be specified by PID.
"spawn" - launches new suspended process, writes shellcode and creates thread. PPID can be specified.
Shellcode is encrypted on server, decrypted right before writing to memory and cleared right after it. Tiny-AES is used for decryption.
Modules are now dynamically loaded from folder and not harcoded.

2025-04-21 15:45:19 +02:00

..

src

…

loader.bin

Agent and BeaconC have new injection capabilities.

2025-04-21 15:45:19 +02:00

popcalc.bin

…

print.dll

…

print.exe

…