Smoke Bot – a new modular bot

– the presence of plug-in modules that extend the functionality of the bot, without affecting the size of the bot (do not need encryption)
– detailed statistics by OS version (digit capacity, privileges), countries and online
– detailed statistics on tasks, downloads / launches, limit on the number, etc.
– tasks for a bot to load an EXE or DLL (LoadLibrary, regsvr32, launch from memory without saving to disk)
– geo-targeting (selective downloads only for specific countries or blocking for certain countries)
– personal tasks for each bot, the ability to ban or remove the bot
– HTTPS support, support for .BIT domains, downloading task files from the admin panel or another URL
– inconspicuous installation in the system, protection of your own files
– the ability to update the bot and backup addresses for otstuk
– the ability to use prefixes (ID) for exe (more accurate statistics and task sharing)
– excluding restarting on a machine with an already running bot (within one license)
– “guest” access to task statistics
– bypassing proactive AV mechanisms ( geoting into a trusted process)
– privilege escalation Low-> High (runas + cmd)
– anti-debug, anti-emulation, sandbox and virtual machine detection
– easy to encrypt (does not contain additional DLL, overlay, TLS, just one section of code)
– work in Windows 7-10 x32 / x64
– small bot size ~ 35 KB

Modules:
– STEALER – module for collecting saved passwords from different programs (browsers, E-Mail, etc.), all passwords are collected and sent to the admin area, where they can be easily downloaded (INTERNET EXPLORER / EDGE , FIREFOX , CHROME , OPERA , CHROMIUM , YANDEX , AMIGO , QQ , OUTLOOK 2007/2010/2013/2016 , THUNDERBIRD , FILEZILLA , WINSCP).

– FORM GRABBER: real-time form grabber with browsers (IE, EDGE, FF, CHROME, OPERA: both 32-bit and 64-bit versions are supported), all POST form requests are intercepted (authorization, payment data, etc.) , HTTPS support, search in admin panel by part of URL or bot ID or keyword from data
– PASS SNIFFER: password sniffer, working in real time with all applications, can capture passwords from FTP, POP3, IMAP, SMTP (AUTH LOGIN), data sent to the admin panel and look like – protocol: // user: pass @ ip: port
– FAKE DNS: advanced DNS spoofing (issue spoofing), works in real time with all applications, allows you to change the IP address for a domain according to the rule, which is set in the admin in the form: site.ru = 127.0.0.1 (does not bypass certificate verification)
– FILE SEARCH: the file search module, searches according to the rules and sends them to the admin panel (it is possible to specify the collection of all files with a specific extension or the exact file name)

– PROCMON: a module for monitoring processes and executing a task when finding the necessary process
– DDOS: the module allows performing DDOS attacks on various resources (domain or ip-address) supports several types of attacks
– KEYLOGGER: module keylogger, intercepts keystrokes in specified applications, supports Unicode
– HIDDEN TV: hidden Team Viewer module (without RDP, without a “parallel” session, the holder sees your actions)
– MINER: module for mining cryptocurrencies (currently only Monero (XMR), only on CPU)
– EMAIL GRABBER: a module for collecting email addresses from popular email clients (Outlook, Thunderbird, The Bat!)