Original repo: https://github.com/HarryLee02/nt205-project
At the time of writing, the malware has been successfully planted, worked as expected and not been caught by Windows Defender on these systems:
- Windows 10 & 11 (newest build)
- Have WinRAR < v6.7 installed
This repo is a clean and fully documented version of my malware project. The malware itself is a DLL that exploit vulnerable executable files. The part exploiting CVE-2023-38831 is an extended part to simulate a full attack from start to finish.
The .bat file seen inside the .rar file is not the full malware. It is an installer that connect back to Havoc C2 server, which is already down, to get the actual malware.
Malware's features:
- Connection with Havoc C2 server.
- Encrypt every files, folders in
Downloads/(this can be changed) using Windows CrytoAPI. - Create Registry key for persistence.
- When CVE-2023-38831 is triggered by users, .exe file installs .bin file from attacker server (crypto.harrylee.id.vn)
- .bin file is then got executed in memory.
The list below is my Vietnamese self-evalute version, may be incorrect:
| ID | Name | Tactic | Description |
|---|---|---|---|
| T1566.001 | Phishing: Spear phishing Attachment | Initial Access (TA0001) | Nhóm setup website giả (crypto.harrylee.id.vn) để người dùng tải file độc hại. Sau khi người dùng mở file mã độc sẽ được thực thi. |
| T1204.002 | User Execution: Malicious File | Execution (TA0002) | Người dùng mở file RAR dẫn đến thực thi script. Kỹ thuật này sẽ phụ thuộc một phần vào việc người dùng mở file .PDF trong thư mục được nén. |
| T1106 | Native API | Execution (TA0002) | CVE-2023-38831 dựa vào luồng/cách thức hoạt động của các hàm trong Windows API như shell32.dll!PathFindExtension, shell32!ApplyDefaultExts. |
| T1059.003 | Command and Scripting Interpreter: Windows Command Shell | Execution (TA0002) | Nhóm thông qua CVE-2023-38831 khiến Windows thực thi Batch script (.bat) và download payload mã độc chính. |
| T1112 | Modify Registry | Persistence (TA0003) | Mã độc khi được thực thi sẽ tự thêm payload (đã download vào %APPDATA%\Microsoft\Windows\Update). |
| T1547.001 | Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder | Persistence (TA0003) | Batch script đã thực hiện sửa đổi Registry tại (HKCU\Software\Microsoft\Windows\CurrentVersion\Run) để mã độc thực thi mỗi khi khởi động. |
| TA0011 | Command and Control | Command and Control (TA0011) | Mã độc thực hiện mở connection về Havoc C2 Server có nhiệm vụ làm Command & Control. |
| T1027.013 | Obfuscated Files or Information: Encrypted/Encoded File | Defense Evasion (TA0005) | Payload được mã hóa AES và decrypt sau khi load vào memory để tránh static analysis của Windows Defender. |
| T1486 | Data Encrypted for Impact | Impact (TA0040) | Các file trong thư mục Downloads bị mã hóa sau khi thực thi. |
This project contains malware code and is intended strictly for educational and research purposes only.
DO NOT run or compile this code on a production system or without proper isolation (e.g., sandbox or virtual environment).
The payload was successfully tested against Windows Defender 11, and may trigger antivirus or other security systems.
The author does not take responsibility for any misuse or damage resulting from this code. Use it at your own risk.