Rust Based Windows Kernel Rootkit
by Loki - Saturday August 3, 2024 at 05:43 PM
The God of Stories
user_229941
Posts: 2,445
Threads: 64
Joined: Jun 2024
Reputation: 1,757

ActiveShoutbox AddictGamer
#1
08-03-2024, 05:43 PM
Features
Process
  • Process (Hide / Unhide) ✅
  • Process Signature (PP / PPL) ✅
  • Process Protection (Anti-Kill / Dumping) ✅
  • Elevate Process to System ✅
  • Terminate Process ✅
  • Lists protected and hidden processes currently on the system ✅
Thread
  • Thread (Hide / Unhide) ✅
  • Thread Protection (Anti-Kill) ✅
  • Lists protected and hidden threads currently on the system ✅
Driver
  • Driver (Hide / Unhide) ✅
  • Enumerate Driver ✅
  • Driver Signature Enforcement (DSE)
  • DSE (Enable / Disable) ✅
  • Keylogger
  • Keylogger (Start / Stop) ✅
Callbacks
  • List / Remove / Restore Callbacks
  • PsSetCreateProcessNotifyRoutine ✅
  • PsSetCreateThreadNotifyRoutine ✅
  • PsSetLoadImageNotifyRoutine ✅
  • Module
  • Enumerate Module ✅
Registry
  • Registry Protection (Anti-Deletion e Overwriting) ✅
  • Injection Shellcode
  • Process Injection (ZwCreateThreadEx) ✅
  • APC Injection ✅

Hidden Content
You must register or login to view this content.



Omnicer
[Image: e47c91a87cc521d1efbd20183b42ee4259c9c593.gifv]
PGP
Reply
Elite User

Posts: 127
Threads: 4
Joined: Sep 2023
Reputation: 0
#2
08-06-2024, 04:30 PM
(08-03-2024, 05:43 PM)Lokie Wrote: Features
Process
  • Process (Hide / Unhide) ✅
  • Process Signature (PP / PPL) ✅
  • Process Protection (Anti-Kill / Dumping) ✅
  • Elevate Process to System ✅
  • Terminate Process ✅
  • Lists protected and hidden processes currently on the system ✅
Thread
  • Thread (Hide / Unhide) ✅
  • Thread Protection (Anti-Kill) ✅
  • Lists protected and hidden threads currently on the system ✅
Driver
  • Driver (Hide / Unhide) ✅
  • Enumerate Driver ✅
  • Driver Signature Enforcement (DSE)
  • DSE (Enable / Disable) ✅
  • Keylogger
  • Keylogger (Start / Stop) ✅
Callbacks
  • List / Remove / Restore Callbacks
  • PsSetCreateProcessNotifyRoutine ✅
  • PsSetCreateThreadNotifyRoutine ✅
  • PsSetLoadImageNotifyRoutine ✅
  • Module
  • Enumerate Module ✅
Registry
  • Registry Protection (Anti-Deletion e Overwriting) ✅
  • Injection Shellcode
  • Process Injection (ZwCreateThreadEx) ✅
  • APC Injection ✅



Omnicer

better not be eagle Sad
Reply
Breached
Member
Posts: 3
Threads: 0
Joined: Apr 2024
Reputation: 0
#3
08-06-2024, 04:48 PM
Mmm rust good, harder 2 detect
Reply
Breached
Member
Posts: 21
Threads: 0
Joined: Aug 2024
Reputation: 0
#4
08-08-2024, 09:32 PM (This post was last modified: 08-08-2024, 09:34 PM by evil_quiddity_1.)
Using Windows' own bootloader to bypass Secure Boot
damn , i am early, lets learn something new
Reply
Breached
Member
Posts: 22
Threads: 2
Joined: Aug 2024
Reputation: 0
#5
08-11-2024, 10:37 PM
this seems interesting
Reply
Breached
Member
Posts: 7
Threads: 0
Joined: Aug 2024
Reputation: 0
#6
08-11-2024, 11:00 PM (This post was last modified: 08-11-2024, 11:09 PM by deepnet.)
Rust is king when it comes to malware....

I'm seeing a crate for shadow-rs as well so this would be pretty cool to have installed by accident thinking they were using the original crate.

Looks cool though, a work in progress
Reply
Breached
Member
Posts: 14
Threads: 0
Joined: Jul 2024
Reputation: 0
#7
08-12-2024, 01:41 AM
(08-03-2024, 05:43 PM)Lokie Wrote: Features
Process
  • Process (Hide / Unhide) ✅
  • Process Signature (PP / PPL) ✅
  • Process Protection (Anti-Kill / Dumping) ✅
  • Elevate Process to System ✅
  • Terminate Process ✅
  • Lists protected and hidden processes currently on the system ✅
Thread
  • Thread (Hide / Unhide) ✅
  • Thread Protection (Anti-Kill) ✅
  • Lists protected and hidden threads currently on the system ✅
Driver
  • Driver (Hide / Unhide) ✅
  • Enumerate Driver ✅
  • Driver Signature Enforcement (DSE)
  • DSE (Enable / Disable) ✅
  • Keylogger
  • Keylogger (Start / Stop) ✅
Callbacks
  • List / Remove / Restore Callbacks
  • PsSetCreateProcessNotifyRoutine ✅
  • PsSetCreateThreadNotifyRoutine ✅
  • PsSetLoadImageNotifyRoutine ✅
  • Module
  • Enumerate Module ✅
Registry
  • Registry Protection (Anti-Deletion e Overwriting) ✅
  • Injection Shellcode
  • Process Injection (ZwCreateThreadEx) ✅
  • APC Injection ✅



Omnicer
Bya to pizdec potimu nelnya prosto vilozit
Reply
MVP User
MVP
Posts: 10
Threads: 1
Joined: Aug 2024
Reputation: 20
#8
08-12-2024, 03:43 AM
This looks cool (recently been teaching myself rust), thank you for sharing <3
Reply
Elite User

Posts: 190
Threads: 5
Joined: Aug 2024
Reputation: 0
#9
08-12-2024, 05:21 AM
This looks like it will be really good cuz I need to learn more languages. Thanks a ton
Reply
Breached
Member
Posts: 4
Threads: 0
Joined: Aug 2024
Reputation: 0
#10
08-16-2024, 05:23 PM
Rust is king when it comes to malware....
Reply


Possibly Related Threads…
Thread Author Replies Views Last Post
  Rust Malware PDF builder (Open SRC) L_DWORD 90 13,228 Yesterday, 06:23 AM
Last Post: WTF69
  Go-based implementation of Cobalt Strike style BOF/COFF loaders Loki 9 1,417 07-28-2025, 07:02 AM
Last Post: toms
  Python Windows information stealer CyberSel 4 397 04-13-2025, 02:32 AM
Last Post: phobiax64
  PrivPy Windows Priv Escalation Python Script pwnengine 2 269 03-31-2025, 05:51 AM
Last Post: pwnengine
  Seeking Skilled C/Rust Developer & Go Backend Developer for Security-Focused Project 0xpff 0 217 03-26-2025, 05:55 PM
Last Post: 0xpff

Forum Jump:


 Users browsing this thread: 3 Guest(s)