Thread: [UMBRALOADER] Persistance Plugin

It will inject Shellcode into explorer.exe; if the process crashes/get killed it will restart it.
Will check for x64 Systems, if its 64bit it will NOT try to inject into explorer.exe!

Howto use:
-Build it with Delphi 7/2007
-Upload to your webhost
-use "Plugin" Command with the URL to persistance.dll
-PROFIT!!!

thanks mate ! can Waite for the form Gerber and soc for 5. good job!

Slayer but why if x64 bit system it's detected it won't inject?is there an issue whit injection in explorer.exe on x64?
BTW some rootkit features would be awesome!

Injecting 32bit code into an 64bit process will cause a crash

Rootkit will be added in the next days, i am working on the Proxy Plugin

profit?

Howto use:
-Upload to your webhost
-use "Plugin" Command with the URL to persistance.dll
-PROFIT!!!

???????????

Originally Posted by chapolind2010

Howto use:
-Upload to your webhost
-use "Plugin" Command with the URL to persistance.dll
-PROFIT!!!
???????????

yep.whats your prob? ^^
Compile it, upload the compiled dll file on webspace, use "Plugin" + "url to dll file" command in umbra Webinterface and get "profit" or "costumers" !

thank you very much slayer!
you are awesome !!!
REP++++


edit:
i am not good in fuding something. umbra is getting dropper.gen.
i think because of the MoveMemory function ? Is it right ? Encrypt function will be solution ?

You should use Crypters if you have problems with detections.

Nice release slayer, I'll take a peak later though.

thanks brother