KOIOS

Tool Used

• C
• PeBear
• IDA
• Visual Studio

Brainstorming

Injection Phase

WinRAR - First Method

• Get an image
• Download Winrar
• Convert image .ico
• Select both image and the executable and click Add to archive

Execution Phase

• Create Process and inject shellcode that we created in assembly
  • Ntdll
  • DllInjector
  • PE with all in it

Features

• Cookies browser
• Details of hardware
• Wi-Fi credentials
• users details on the computer
• details on av
• list of software installed
• list of security patch
• firewall rules
• Get Geolocation
• Dump Lsass