Red57 Virus
Delphi is written in 7 and has no addiction. Botnet , Trojan , Keylogger , CPU Miner , Autorun.inf features such as. I have developed as a hobby in my free time for more than 10 years. .Exe , .excel ,.
WARNING: These codes are shared only for educational purposes. I do not accept responsibility.
Warning: Do not run on your own computer. It affects all files.
WARNING: The software is not further developed.
Requirements
Details and usage
- For the remote connection, you must direct your connection port to the machine where the server runs.
- In order to connect the Client to the server, the IP addresses must be the same. Client does not display a form that it works on the screen in any way. It can take about 3-5 minutes to work in the background.
- Botnet Clienti is set to 127.0.0.1 ip address.
ClientMain.pas:63 lines. It takes about 3 minutes to connect to the server. To avoid antiviruses, the system waits for a while without any action in the background. - It works as an admin on Client XP. The operating system is not very safe already :)
- It uses Msconfig or timed tasks to start working as an admin on Win7 and Win10.
- FlashDisk and external discs follow the file changes and infect the files that can be transmitted. The system does not tire unnecessary.
- Desktops, documents, flashdisk, external disk, such as sections occasionally tries to transmit and infection.
- Excel adds VB6 Macro code to Word files and tries to infect itself. It forces the user by hiding pages for the user to activate the macro at the beginning. Word should be installed in the machine to contaminate the excel files, or it is not infected.
- All string (articles) in the codes are encrypted with Xor Encoder. The aim here is to prevent antiviruses from analyzing the stars in memory. (Method names were also called meaningless in the same way)
- Since some Windows aparts are generally abused and I needed to use them, I used these aparts dynamically encrypted. You examine the ukbrddl.pas - uwin.pas file.
- All encryption is made through the uenc.pas file.
- It makes all the operations required for Client to work at the beginning. Even though I have different thoughts for this section, so much with Delphi7 :)
- Keylogger records keyboard strokes. Windows API is used and has been plugged by many antiviruses. I have worked hard to hide it, but some antiviruses are hard to hide all because they sometimes scan on memory.
- With Botnet, the following operations can be performed on the client: Getting a screen image, CMD access, file manager, mine, system information, Kes-Kopya-paste, etc.
- Windows API was used in this version while using "Delphi Indy9" for Botnet. Antiviruses can easily capture because the apiler and protocols used are old.
Do not operate on your own machine. Install and try virtual server with VirtualBox. I did not enter a fantasy as to restore the infected files, then you don't have a headache.
Finally, it is completely a product of pleasure, it does not contain any intention. It started in high school years and occasionally developed.
