PROJECT: GoneGhost

Description

I have been working on this ring3 rootkit to hide processes, files/folders, registry keys and more. I have took inspiration from @bytecode77 for his r77 rootkit. There many more future changes that I want to make but because of my limited time, updates may take some time. I am still a new Malware Dev so expect bugs and issues!!

FEATURES:

• ✅ Hide processes via NtQuerySystemInformation hook.
• ✅ Hide Files/Folder via NtQueryDirectoryFile hook. (NtQueryDirectoryFileEx needs some work.)
• ✅ Hide registry keys from the registry via NtEnumerateKey and NtEnumerateValueKey hook.
• ✅ Using detours hooking library to hook these functions.
• ✅ Hiding files, folders, registry keys, and processes with prefix.

Current task

2. Indirect syscalls.
3. if needed api hashing
4. String hashing

Next up

Work on evasive payload injector:

1. Shellcode Reflective dll injection.

Later date