[b][size=18]Unikorn Flexible Loader 1.2.1[/size][/b]

Hello there,

I'm glad to introduce one of my products to darkode members. Here's the Unikorn FlexLdr 1.2.1.
As in its name, it's basically a loader bot which stays in background, downloads then execute files
under master's commands.

Moreover, FlexLdr is not only a loader, but also a platform, designed with modular in mind,
so that, it's possible to intergrate other plugins with rich features into FlexLdr on-the-fly.
For example, they are SOCKS5, Advanced DDoS (HTTP/TCP/UDP). Plugins currently in development is:

+ Hotmail spam sender (login hotmail over http and support registering hotmail accounts)
+ Emails crawler.

More plugins can be intergrated in the future such as: formgrabber, screenshot, webinjects,
VNC and many others, only limited by imagination.

[b][size=18]STANDARD EDITION[/size][/b]
-----------------

[b][u]Key features[/u]: [/b]

+ Tested and working stable on following 32bit systems:

•	Windows XP SP2, SP3
•	Windows 2003 Server
•	Windows Vista
•	Windows Vista SP1
•	Windows 7 x86 SP0
•	Vista SP2

+ Work with both Admin & Guest privilege
+ Supports multiple controler servers.
+ Supports downloading with HTTP/HTTPS
+ Supports encrypted file downloading and executing.
+ Supports task-based loading. User scan start/stop/delete tasks at ease.
+ Supports loading unlimited or limited files specified in Admin CP.
+ Supports reporting failure at downloading or executing remote file.
+ Supports loading files per group of countries.
+ Supports two downloading type: URLDownloadToFile and WININET.
+ Downloading files will be executed with highest privlege possible (most of time it's SYSTEM).
+ Downloaded files can be specified deleted after execution or not.
+ Bots are identified uniquely, files are executed only one per bot.

[b][u]Unikorn FlexLdr Special features[/u]:[/b]

[b][color=red]- Bypassing Windows 7 UAC.
- Maximize the successful installation rates by unique infection vectors.
- Bot can be installed mutilple approaches: installed as service with DLL or single exe.
- Unique installation injection scheme (no QueueUserAPC(), OpenProcess(), WriteProcessMemory() and CreateRemoteThread())[/color] [/b]
- Evading HIPS/personal firewall by anti-usermodehooks (restoring abitrary instructions, not only 5 bytes) on several system DLLs such as ntdll.dll, kernel32.dll, advapi32.dll etc,.
- Anti-memory forensic and scanners.
- Hybrid techniques which make antirootkits fail (tested RkU3.8.384.586, GMER 1.0.15.15281, RootRepeal 1.3.5)
- Evade NIDS by encrypted communication with controler server, support both HTTP/HTTPS.
- Each bots build has unique communication builds.
- If installed with Admin privilege, bots will be executed with SYSTEM privilege.
- Designed with modular in mind, supports PLUGINS and SDK.
- Asynchronous API usage instead of synchronous APIs, makes bots more stable and reliable.
- Multi-threading based helps increasing stability and robustness.
- Bots can disable kernel mode HIPS's hooks (both SDTs, harddisk filter drivers). Tested with following personal firewall and HIPS on Windows SP2/3 without patches:

•	Kaspersky Internet Security 2009
•	Outpost Firewall Pro 2009
•	Online Armor Personal/Premium/++ v4.0.0.15 (even with enable Run Safer, which reduce privileges of the loader)
•	Zone Alarm Pro 9.0.112
•	Comodo Internet Security 3.13.121240.574
•	F-Secure Internet Security 2010 v10.00.246
•	Kerio WinRoute Firewall v6.7.1.6399
•	BitDefender Internet Security 2010
•	Jetico Personal Firewall v.2.1.0.7 (* Firewall still show outbound connection)
•	DefenseWall 2.56
•	Malware Defender 2.5.0
•	PC Tools Firewall Plus 6.0.0.86

+ Bot's size is 40 ~ 70KB and can be packed with cryptors/protectors.
+ All written in C and ASM


[b][size=18]ADVANCED EDITION (or so-called version 2.0):[/size][/b]
-----------------

- [b][color=red]Kernel mode driversupports advanced rootkit hidding files techniqes. 100% bypassed ALL avaiable antirootkit
you can use :’) Tested with lastest RkU, GMER, RootRepeal, DrWeb CureIt. It's actually advanced, which you can maybe never see it on sale, I guarantee this.[/color][/b]

The rootkit protects file at sector-level of harddisk, i.e it fakes the real content of the file from AV scanner with content of random
clean PE file. Therefore, AV regconize the file as innocent. Moreover, it also protects threads, processes and virtual memory
of the injected process, which make memory scanner and process/thread terminator useless.

- [b][color=red]Support fallback domains which bots generated based on current date. [/color][/b]
If you domains/control server is cut-off, you still can calculate the new domain name bots communicate to
in the abitrary specified date. Bot will download your updated EXE from here, verified if it's actually from you.
If it is, execute it. If not, bot will try another domain. Bots will connect ~7000 domain in a day.

- Bot DLL is like standard version, contains all features of standard edition.
- Bot DLL is injected from kernel mode and store encrypted raw on disk sectors, not by traditional filesystem.
Explorers and other file system browsers cannot see this DLL.
- Currently in beta testing phase.

[b][size=18]ADMIN CONTROL PANEL:[/size][/b]

+ Easy to install
+ Admin can easily administrate on detailed graphs and statistic.

[b][size=18]PLUGIN features:[/size][/b]

+ All plugins are encrypted and loading on-the-fly without writting to disk.
+ If you can code, SDK can also be provided with reasonable price.

Two available plugins:

[b]+ SOCKS5 plugin:[/b]
•	Asynchronous socket usage, which makes the SOCKS very stable and reliable
•	Support authorization
•	Periodically change port / username / password.

[b]+ Advanced DDOS plugin supports:[/b]

•	[b][color=red]Driver-based networking [/color][/b]
•	HTTP/HTTPS ddos
•	TCP ddos supports SYN/ACK/random DATA ddos
•	UDP ddos supports random DATA ddos
•	[b][color=red]With HTTP DDoS, all fields of HTTP headers can be configured and choosing randomly (see screenshot) to combine
	which makes it be the most powerful DDoS tool ever on the market. [/color][/b]
•	[b][color=red]HTTP/HTTPS ddos bypass anti-ddos solutions by authorization and cookies dynamically.[/color][/b]


[b][size=18]Screenshots:[/size][/b]

[b]Real life STAT Board:[/b]

[img]http://img688.imageshack.us/img688/6244/stat2l.jpg[/img]

[b]Real life LOAD Board:[/b]

[img]http://img192.imageshack.us/img192/9085/load2u.jpg[/img]

[b]Real life CHART Board:[/b]

[img]http://img684.imageshack.us/img684/9461/chartj.jpg[/img]

[b]Graphic Statistic about bots activities[/b]

[img]http://img695.imageshack.us/img695/3685/graph2.jpg[/img]

[b]Advanced DDoS options[/b]

[img]http://img101.imageshack.us/img101/3876/99020110.jpg[/img]
[img]http://img683.imageshack.us/img683/477/ddos1h.jpg[/img]
[img]http://img6.imageshack.us/img6/4696/16817376.jpg[/img]
[img]http://img177.imageshack.us/img177/2696/ddos2.jpg[/img]


[b]Other Boards:[/b]

http://img63.imageshack.us/img63/9547/loginf.jpg
http://img682.imageshack.us/img682/1354/optionscu.jpg
http://img96.imageshack.us/img96/8708/builds2.jpg



[b][size=18]PRICES:[/size][/b]
- Support free 15 bot builds exe for each customer.

+ Standard edition:
- First domain: [color=green]550 WMZ [/color]
- 5 next addon domains: [color=green]110 WMZ/domain[/color]
- 5 Next domains: [color=green]50 WMZ/domain [/color]
- 5 Next domains: FREE
- Free support

+ Advanced edition:
- First domain: [color=green]1600 WMZ [/color]
- 12 months support

+ SOCKS5 plugin: [color=green]150 WMZ[/color]
+ Advanced DDOS plugin: [color=green]800 WMZ[/color]

+ SDK: PM/email for price.