Suicide via Remote Code Injection


A feature which very common among malwares that is "Self-Deletion". Malware authors uses various techniques to delete it self after successful infection. Very famous malware Flame had a built-in feature called "SUICIDE" that can be used to uninstall the malware from infected computers.

Please remember this information is for Educational Purpose only and should not be used for malicious purpose.I will not assume any liability or responsibility to any person or entity with respect to loss or damages incurred from information contained in this article.

Last night I wrote a very simple program that deletes it self without making any new copy of itself or creating any new process.
It actually injects some raw machine code (ShellCode) to any legitimate process and creates a new thread under that process. So when the injected ShellCode execute it deletes the main executable.

So here how it injects code to another process in this case it injects to explorer.exe. Its very common and usual technique to inject arbitrary code into any other process's address space.

So when you execute the compiled binary,

1) It first resolves the PID of explorer.exe. We know that explorer.exe is a process which will always be present in any windows system.
2) After getting the PID it gets the Handle to explorer.exe by using OpenProcess() API.
3) After that it allocates some memory on the remote process's (explorer.exe) address space for our ShellCode using VirtualAlloc() API.
4) After successful allocation it uses WriteProcessMemory() to write the shellcode into remote process.
5) Then it creates a new thread,which will then create a thread and execute the injected shellcode.

Few things about injected shellcode:

I have written the ShellCode in such way that the executable file path (file to be deleted) can just be appended with ShellCode.
Sot the main executable actually writes the [Shellcode]+[Full path of itself] to explorer.exe

The ShellCode present in this below example is HardCoded so it should only work on WinXP SP2 system.
When our main executable transfer the control to our shellcode it waits for 5 seconds (Usign Sleep!Kernel32.dll )and then delete the main executable using DeleteFile!Kernel32.dll.

Here is the C code.


Comments

  1. Bihar School Education Board (BSEB) has Upload the Bihar Matric Model Paper 2022 for Hindi, English Medium, Latest Model Paper Announced Share a huge Change in the Question Pattern, As per the Model Set Paper, the Students would now have 50 per cent choice in the Sample Paper, Bihar Board Model Set Paper 2022 for 10th Class are now Available on BSEB 10th Model Paper 2022 Students are Advised to go Through the same Carefully to Understand the changes in the paper pattern. The change in Bihar Matric Exam Model Paper Pattern 2022 is also explained.

    ReplyDelete
  2. WBBSE 7th Class Syllabus 2023
    West Bengal Board High School Parents can use the Syllabus to Understand the Concepts and Prepare their Children for the Exam, Accordingly, WBBSE 7th Class Syllabus 2023 The West Bengal 6th, 7th, 8th, 9th, 10th Class Syllabus 2023 All Subject Chapter Wise Students Prepare for the Upcoming 6th, 7th, 8th, 9th, 10th Class Exam, it is quite Essential that they have the Complete Knowledge of the West Bengal 6th, 7th, 8th, 9th, 10th Class Latest Syllabus 2023 of All Relevant Subjects, Knowing the Details of Prescribed Topics and the weight age Allotted to Them Makes it easy to plan your Studies Meticulously so that you can make Effective Preparations for your Exam and obtain desired marks.

    ReplyDelete
  3. CBSE 4th Class Textbook
    CBSE Textbooks for 1, 2, 3, 4, 5, 6, 7, 8, 9, 10 Class English, Hindi, Mathematics, Science, Social Science, and Sanskrit are available in this webpage. You will get the Download links of CBSE 1, 2, 3, 4, 5, 6, 7, 8, 9, 10 Class Textbooks 2023 Students 1st Class which will help to prepare Final Examination Prepare of CBSE Board. Central Board 1, 2, 3, 4, 5, 6, 7, 8, 9, 10 Class Students your Textbooks online provide our website, CBSE 4th Class Textbook Visit our web portal Download CBSE 1, 2, 3, 4, 5, 6, 7, 8, 9, 10 Class Books 2023 Pdf links. CBSE 1, 2, 3, 4, 5, 6, 7, 8, 9, 10 Class Textooks 2023 are Quite Important when we talk about the Central Exam as these 1st Class book are Prepared as per the Syllabus Prescribed for CBSE Exam. so the CBSE � NCERT 1, 2, 3, 4, 5, 6, 7, 8, 9, 10 Class Textooks 2023 can be Considered as the Complete Preparation Material for the Exam.

    ReplyDelete

Post a Comment