Project Aquatone

[Zesh]

Quick thanks to dsman and bubzuru for the revival of my motivation

Project Aquatone will be a malware piece that I will be developing for the hell off it and as a direct competition to bubzuru key logger. It will be written in Visual Basic 6, time to show off the power of BASIC! I've got a few features and ideas in mind but I'm going to start of small and then build up.

Features

• Key Logger - I've ditched the unreliable GetAsyncKeyState approach and will be using a DLL hook that will also hook the mouse.
• Screenshots - A simple timmer that will trigger a screenshot to be taken at regular intervals.
• Server/FTP - Aquatone will first try to connect to a server to upload data and to recieve commands from, if a connection to the server cannot be made, Auqatone will fall back onto a FTP connection.

Here's a look of what I've got so far:

The listbox at the top contains all of the hook events, whilst the textbox displays a readable representation of the keyboard events. So that's the key logger feature pretty much done, I do have an idea of invoking the logging when certain programs are running but I'll add that later. Next up is the screenshot and server/ftp features which are rather simple and then I'll start messing around with some fun stuff

[Kulverstukas]

Oh dear lord. Doesn't all lame keyloggers get written in VisualBasic? just asking...

[Zesh]

Oh dear lord. Doesn't all lame keyloggers get written in VisualBasic? just asking...

Nope. Every language has lame keyloggers and mine isn't lame, using a hook puts my program above most other keyloggers made in VB6

[techb]

Vb is lame in my eyes regardless. But that is from personal experience though. C would be a better option, or C# if you want to go proprietary. Good luck though, any language is a whole lot better than none. I took Vb in college and it was a joke. Industry seems to enjoy it though.

[Zesh]

Well yes, everyone has their own opinions. I quite like VB6, it can be quickly used to whip up a program and it's the language I started off with, due to my game development endeavours with Mirage and its variants. The other option I have is C++ but my learning of that language is currently based around my game developers course and as I'm better with VB6, its what I'll use.

A quick update: Screenshot feature is in. Simply changing the number in the textbox changes the interval of each screeny in Minutes and for some reason I decided to keep track of how many keys have been pressed



Now, I'm going to step it up and start turning this program into something better than the "lame" crap. Next up is the server/ftp feature, a better UI and a few other little things.

[Huntondoom]

little bit of source code (A)?

[dsman]

Good job bro ^^

[bubzuru]

good to see iv inspired you to start working again
(little tip: Try hooking KeyPress insted of KeyUp\Down, or hook both. key pressed is not good with certen keys (up, down, windows etc. use key up to log these) but use keypressed to log the rest (good with shift, space, shift\key $, etc)

[bubzuru]

here this will come in handy

DEC OCT HEX BIN Symbol HTML Number HTML Name Description 0 000 00 00000000 NUL Null char 1 001 01 00000001 SOH Start of Heading 2 002 02 00000010 STX Start of Text 3 003 03 00000011 ETX End of Text 4 004 04 00000100 EOT End of Transmission 5 005 05 00000101 ENQ Enquiry 6 006 06 00000110 ACK Acknowledgment 7 007 07 00000111 BEL Bell 8 010 08 00001000 BS Back Space 9 011 09 00001001 HT Horizontal Tab 10 012 0A 00001010 LF Line Feed 11 013 0B 00001011 VT Vertical Tab 12 014 0C 00001100 FF Form Feed 13 015 0D 00001101 CR Carriage Return 14 016 0E 00001110 SO Shift Out / X-On 15 017 0F 00001111 SI Shift In / X-Off 16 020 10 00010000 DLE Data Line Escape 17 021 11 00010001 DC1 Device Control 1 (oft. XON) 18 022 12 00010010 DC2 Device Control 2 19 023 13 00010011 DC3 Device Control 3 (oft. XOFF) 20 024 14 00010100 DC4 Device Control 4 21 025 15 00010101 NAK Negative Acknowledgement 22 026 16 00010110 SYN Synchronous Idle 23 027 17 00010111 ETB End of Transmit Block 24 030 18 00011000 CAN Cancel 25 031 19 00011001 EM End of Medium 26 032 1A 00011010 SUB Substitute 27 033 1B 00011011 ESC Escape 28 034 1C 00011100 FS File Separator 29 035 1D 00011101 GS Group Separator 30 036 1E 00011110 RS Record Separator 31 037 1F 00011111 US Unit Separator

[/td][/tr][/table]

[Zesh]

little bit of source code (A)?

Which little bit?

Good job bro ^^

Thank you

@bubzuru - Thanks for the tip and table

I'm going to leave this here, I'll do a proper w/ text update in the morning * yawn *

[Huntondoom]

Which little bit?

Thank you

@bubzuru - Thanks for the tip and table

I'm going to leave this here, I'll do a proper w/ text update in the morning * yawn *

the secret to your powers!
the hook :3

[EmilKXZ]

Oh dear lord. Doesn't all lame keyloggers get written in VisualBasic? just asking...

Agreed.

Everything that doesn't run native in the OS is lame to me. A C# keylogger would go lame too if I have the standard XP without .NET (it doesn't come by default). On the other hand, there are good pieces of malware that are framework-based, such as Managed Code Rootkits, I acknowledge the good work, it's just doesn't sound to me too real to employ a malware tool which requires the user to have installed something extra that doesn't come by default. I honestly don't know, but I think .NET comes by default in Windows 7. Enlighten me if I am wrong. 

[bubzuru]

Yes .NET comes by default in Windows 7 (i cant see it going anywhere in the near future)
and most people install it some reason

if you read my old posts you will see that i used to hate .NET when i was on XP.
now i love it.

[Kulverstukas]

Developing a more serious virus, you cannot rely on what people _should_ have installed in order for the malware to run. Unless you are targeting a very specific module, but that's another story.
My point is, if you are creating something that you will later have to get data from without end-user knowing and you won't have complete control over it, you cannot rely on "if" factors. It needs to be solid. And .NET, Java or anything else that takes up vital organs in an executable does not qualify as solid.
But you probably all know that already.

[bubzuru]

thats why i like delphi so much
but all that unicode string bullshit in the new version got me down
(broke all my code)