nullexceptiontsb/haemolacria

a "process-less" trojan

Haemolacria

malware!

THIS REPO IS MALWARE !!! I AM NOT RESPONSIBLE FOR ANY DAMAGAE CAUSED BY IT. SEE LICENSE FOR MORE INFO
all things considered, this one isn't so bad. destructive if it starts on 03.01. where it prevents creation of threads by explorer, kills lsass and overwrites the MBR otherwise launches a short, progressing GDI payload. operates within a DLL injected into explorer.exe and lsass.exe
the injector (HaemolacriaLoader) only writes the DLL file to the disk, sets itself up to run at startup and injects the DLL into the above mentoned processes
the payload (Haemolacria) is the actual payload which does all the fun stuff. it is also slightly less of a mess

oh and the code is the definition of a mess

has been demonstrated in a video by Siam Alam: https://www.youtube.com/watch?v=YDUVo_4ybRU

for a more readable DLL injection implementation see my gist at https://gist.github.com/NullExceptionTSB/837fc5e76003974faaa0e11d9ede6d51

NOTE: tested only on Windows XP but most R&D was done on Windows 7 so it could possibly work there too

haemolacria's Issues

Module NullException is missing

Hello there,
Aeroplane was working properly until a few days ago when the module NullException went missing for no apparent reason, and i can't find it anywhere.

It's a critical element in aeroplane and nothing appears to work properly without it.

Could you please provide it ?

I opened a new pseudo-permanent xmpp server :
IP : 185.163.126.95
or
Domain : yuri.life

Registrations are currently open, join "general" channel for more info.

-Midori

PS: ily <3

low skill h4x0r

im noob give me comipled pls