Our Friendly Gmail will act as Server and implant will exfiltrate data via smtp and will read commands from C2 (Gmail) via imap protocol
? [Disclaimer]: Use of this project is for Educational/ Testing purposes only. Using it on unauthorised machines is strictly forbidden. If somebody is found to use it for illegal/ malicious intent, author of the repo will not be held responsible.
EAGetMaillibrary from Nuget Package Manager.
Costura Fodyfrom Nuget Package Manager, in order to bundle up all the dlls altogether. This actually bulked up my implant, but for this case, I don't think that will matter much as this implant is FUD till now :).
Precausions to be taken by Operator before Using Gmail as C2:
- Make sure the Command sent via Gmail, is in
UnreadMode (if not, mark as Unread) as the implant scans the
Last/latest Unreadmail and checks whether it starts with "
in:" or not. If it does start with "
in:", it understands that, that particular textbody is a legit command, and marks that particular mail as
Readand this continues till the end.
Here is the snippet:
- Using Antiscan.me:
- Capa Scan:
It seems like capa is not able to detect the capabilties of my Client implant at all. But definitely creates suspicion, forcing the Malware Analyst to give the binary a second look.
- WireShark Packet Capture:
We can see that the sent commands via Operator via Gmail and the informations that are exfiltrated/ sent out are all encrypted by Gmail's TLS encryption. On top of that, the ip address (marked) isn't suspicious at all, or in other words are OPSEC safe.