Imagen


Solar is a professional shellcode based bot. It has the ability to fully hide in any windows system from Windows XP SP0 till Windows 8 latest service pack. Solar features various DDOS methods, herding options and a Formgrabber to grab HTTP, HTTPS and SPDY forms from Internet Explorer, FireFox and Chrome and grabs POP3 and FTP login credentials from most email and ftp clients.



Detalles Tecnicos:
Coded in Lazarus (Pascal)
Code is fully relocatable (Shellcode)
Uses custom CRC32 API loader
Uses BeaEngine Disassembler for x86 and x64
Uses named pipes for inter-process communication
Multpiple layers of encryption and compression
Global Ring 3 rootkit
No own process
Fully Unicode
No dependencies (Only standard system DLLs)
Multiple Anti-Debug methods
Unique Server->Bot traffic encryption
Anti bot installation

Funciones:
Internet Explorer Formgrabber
Mozilla FireFox Formgrabber
Google Chrome Formgrabber
SPDY Grabbing
FTP and POP3 Grabber
SlowLoris DDOS
SlowPost DDOS
GET Flood
UDP DDOS
Update and Download System
MD5 Verified Update and Download System
Reverse Socks 5
Browse URL (Visible)
Browse URL (Hidden)


USAR EN ENTORNOS VIRTUALES.

Descarga:
[Enlace externo eliminado para invitados]


DeceptiveEngeenering.
Me gusta esta botnet, aunque lo que no me gusta es el startup basura que tiene, de resto una preciocidad.
Veterano

Las apariencias engañan.
Rusian0 escribió:alguien lo analizo? la verdad no soy bueno analizando.. vi usar en entornos virtuales y... xD
No voy a subir tools infectadas, pero siempre esta bien ejecutar todo en virtuales..
[Enlace externo eliminado para invitados]

sb.zip:

md5: D08BCE8015F22DD0AFA51325D3E9ECCC

SHA1: 524B748C3E6E4E71D448F61C3DEF52BABBD72A47

SHA256: 55679269049AAB21445CA4B52063B1972C2F388F2A7BD718B27FFA65C4ECF4D7

SHA384: 45066D1A573B5B804B13DB798F5993C9EB5D6CDD71DD4CC80FF2DC1645EC72B5C99E8E9320CA5A1425E182780CCC3218

SHA512: 3BFFB5DC320E6D2220699337C11DEFD42EFC62F6CE5947B31286E7F551259FCB586782A9855A7987FB1176E009730EE5E85852C1A93F903AB7A1BC7A562DE740


Process.Start("http://www.wabisorsoftware.com")

Mostrar/Ocultar

Responder

Volver a “Troyanos y Herramientas”