• A bug fix has been implemented for the execution of shell commands. All commands should now execute without causing the entire application to hang.
• Protocol version checking between the Command and Control (C2) and Agent(s) has been incorporated. If a protocol version mismatch is detected, the agent will be disregarded by the C2.

The release of version "3.0 Final" signifies the culmination of this project. I will not be adding any further features; the objective of this PoC was to demonstrate the creation of a reliable and secure C2 utilizing FTP(S). You're encouraged to develop your own version with tailored functionalities. As an exercise, you might consider implementing multi-threading tasking to prevent the application from hanging during long-duration tasks.

I will, however, continue to provide support for the project in terms of addressing potential bugs or opportunities for optimization.

• Enumerate COM Object (Method & Properties) - File only (not in-memory yet)
• Possibility to select which items user want to enumerate (exported function, com properties or methods)
• Few application icons updated for more confort.
• Virtual TreeView component updated to version 7.6.4.
• Compiled with Delphi 11.3.

• Code Optimization: The codebase has been optimized for better performance.
• Protocol Improvement: The communication protocol has been enhanced and is now more modular, allowing for greater flexibility.
• Support for Different RSA Key-Pairs: C2 and agents can now operate with different RSA key-pairs, enabling them to coexist without conflict on the same FTP server.
• Implementation of Dangerous Action Validation Delegate: A validation delegate has been implemented to prompt users for confirmation before executing potentially dangerous actions.

Support for encryption has been introduced, utilizing RSA and AES-GCM 256-bit algorithms, to safeguard the integrity and confidentiality of communications between agents and the C2 server.

SharpFtpC2 is a small, experimental project aimed at exploring the possibility of using FTP(S) for relaying commands and responses between two remote computers. It employs the FTP protocol as a makeshift tunnel through which the computers, both acting as clients connected to an FTP server, can communicate. A simple session management scheme is used to keep track of the exchange of requests and responses.

An alternative version of the code snippet, crafted in Delphi, has been introduced for the "C2 via FTP(S)" technique. This variant expertly demonstrates the employment of the Windows API's from Windows Internet (WinInet) library.

A freshly added Unprotect C# code snippet elucidates the implementation of the "C2 via FTP(S)" technique. This example adeptly showcases the utilisation of the .NET Framework's WebRequest and FtpWebRequest classes, illustrating the steps to effectively execute tasks, handle requests, and manage responses through FTP (File Transfer Protocol).

In this inaugural instalment of the Malware Retrospective series, we take a trip down memory lane to revisit the Beast RAT, a notorious Windows RAT (Remote Access Trojan) developed by the elusive “Tataye.” This groundbreaking malware left an indelible mark on a whole generation of enthusiasts, including myself, who were captivated by its ingenuity and influence the whole scene back in it’s time.

A new version of the unprotect portal has been released with updates including:

• Migration from Bootstrap 4.x to the latest 5.x
• A complete rewrite of the style using SASS
• Multiple improvements, optimizations and refactoring
• Implementation of the first version of FeaturedAPI.

FeaturedAPI is a new feature that allows for the mapping of common Microsoft Windows API's used by specific evasion techniques, with the ability to consult the most commonly used API's for each technique and their associated caution level (Low, Medium, High) as well as access to official and unofficial documentation.

The team is also making progress on the sample scanner to match scanned samples to potential fitting techniques.

We are thrilled that our new tool, DLest, was featured on the Qualys blog in the "New Tools & Techniques" section for December 2022. Keep an eye out for more exciting updates from us in the future!

DLest is a Microsoft Windows application that helps developers and malware analysts analyze and manipulate exported functions in Portable Executable (PE) files, especially DLLs. It allows you to enumerate exported functions using various methods and supports the analysis of memory-loaded modules in real time. It also has the ability to dump a reconstructed version of any module for further analysis. DLest is fully multithreaded and efficient for processing large numbers of PE files. It is useful for developers and malware analysts and streamlines their tasks.

• Introduction of an option to keep certain information when process debug stops.
• Program title is now dynamic (display debugged process id and elevation status).
• Introduction of worker internal thread handling system.
• Possibility to enumerate loaded modules.
• Possibility to support child process inspection.
• Memory map now support child process inspection.
• Possibility to dump and partially reconstruct a portable executable image from memory (main and loaded modules).
• Several code improvements.

• Possibility to view debugged process memory map.
• Possibility to dump debugged process memory region(s).
• Exception handling system added (beta).
• Logging system added.
• UX Theme support.

We are excited to announce that our latest tool, PsyloDbg, has been featured in the "Tools & Exploits" section of Bad Sector Labs Blog's Last Week in Security. Stay tuned for more updates and improvements to come from us at PsyloDbg!

PsyloDbg is a versatile, user-friendly, and open-source debugger for the Windows platform. It is entirely written in Delphi, and its purpose is to assist malware analysts in their work by providing them with a fast and effective tool. As a result, analysts can save time and improve their response to malware threats.

New Unprotect C# Code Snippet added for technique Timestomp.

This tiny code snippet demonstrate the principle of file time stomping.

Steps:

• Enumerate files in current directory (excluding the target file).
• Sort enumerated files by modification date.
• Takes the most recent file and apply its File Creation Date, File Last Modification and File Last Access to our target file.

Additional information:

• Supports relative target file.
• If no files lives inside the current directory, then current directory (parent folder) date information are used.
• If no files lives inside the current directory and current directory is a root path, then timestomp procedure fails.

New Unprotect Delphi code snippet added for technique Process Hollowing, RunPE with support of both x86-32 and x86-64 in a single code.

New Unprotect Delphi Code Snippet added for technique Checking Mouse Activity