passive/cleo

C++ malware specifically built to extract Discord authentication tokens and personally identifying information.

Cleo

Malware written to target windows machines, easily detectable if you have a good anti-virus however tries to become UD on scantime.

If you encounter an error or issue, make an issue here.
Lastly, if code here is used for something else, give credit where credit is due.

Features

Note: PERSISTENCE IS NOT INCLUDED WITHIN THE CURRENT BUILD

Feature	Description
Silence	Process is hidden when ran.
Info Grab	Grabs ALL important PC information & discord account information.
Persistence	Runs at startup & infects discord installation.
Anti VM	Checks system manufacturers & names that are virtual machines (exits if detected)
Anti Debug	Uses methods to check if program is being debugged. (exits if detected).
Anti Analysis	Checks if an analyzing process is open. (exits if detected).
Obfuscation	Automatic compile-time string obfuscation.

Build

Steps for building/compiling Cleo yourself.

Dependencies

All dependencies listed can be installed automatically by running the powershell script here.

• LibCurl - Used by CPR behind the scenes.
• CPR - Simply a wrapper over LibCurl, used for all HTTP requests in Cleo.
• JSON Parser - For parsing discord account information.
• AyObfuscate (xorstr) - Used for hiding important strings.

After installing dependencies, make sure it's all statically linked.
Then, make sure you compile on Release Mode. (x86)
Make an issue here if you get any compilation errors.

Making it FUD on scantime

Make sure all strings related to Discord are obfuscated on compile-time.
- Sign your file.

Make sure not to build with debug information.

Credits

• Passive
• Dehoisted - Wrote previous versions of Cleo and the anti-debug + Discord modules

cleo's Issues

[Issue]

Are you ever going to re implement or improve persistance? Id also advise adding polymorphic ease of compilation to maybe add a seperate compiler/distribution module for handling that ie auto update the xor key

title

annyoign [Issue]

Hello, I am having an issue with (x).

Errors: (x).

I am running Windows version (x) and my specs are (...)

I compiled with the build configuration (x) and am using the IDE (x)

(extra information)

In order to reproduce this problem you must, (x).

cock

uwu

[Issue]

Hello, I am having an issue with (x).

Errors: (x).

I am running Windows version (x) and my specs are (...)

I compiled with the build configuration (x) and am using the IDE (x)

(extra information)

In order to reproduce this problem you must, (x).

[Issue]

Hello, I am having an issue with (Compilation).

Errors: (None).

I am running Windows version (10 Pro) and my specs are (CPU i5-4310 2c4t)

I am new to this compilation and idk how to compile this;
ive searched for tutorials and solutions but i am unable to find help

In order to reproduce this problem you must, (not compile).

[BUG] Not finding tokens within google chrome?

Orlando, when you wake up I hope you see this issue and look into it.

When running the compiled program, It does not seem to find tokens within the google chrome directory. Maybe it is not finding
it because of the space in the directory name?

Best regards - Passive.

Install Process unknown

Hello, I have installed the required dependencies but from here I have no idea what to do.
How do i go about installing Cleo and setting it up so that discord tokens get sent to my computer?

Many thanks.

[Issue]

Hello, I am having an issue with (x).
Cant build
Errors: (x).
Build started...
1>------ Build started: Project: Cleo, Configuration: Release x64 ------
1>Anti.cpp
1>C:\Users\mbell\Desktop\Cleo-main\Cleo\Anti.cpp(17,56): error C2429: language feature 'init-statements in if/switch' requires compiler flag '/std:c++17'
1>C:\Users\mbell\Desktop\Cleo-main\Cleo\Anti.cpp(24,1): error C2511: 'void Anti::check_usernames(void) const': overloaded member function not found in 'Anti'
1>C:\Users\mbell\Desktop\Cleo-main\Cleo\Anti.h(12): message : see declaration of 'Anti'
1>C:\Users\mbell\Desktop\Cleo-main\Cleo\Anti.cpp(33,48): error C2429: language feature 'init-statements in if/switch' requires compiler flag '/std:c++17'
1>C:\Users\mbell\Desktop\Cleo-main\Cleo\Anti.cpp(36,49): error C2429: language feature 'init-statements in if/switch' requires compiler flag '/std:c++17'
1>C:\Users\mbell\Desktop\Cleo-main\Cleo\Anti.cpp(39,49): error C2429: language feature 'init-statements in if/switch' requires compiler flag '/std:c++17'
1>C:\Users\mbell\Desktop\Cleo-main\Cleo\Anti.cpp(42,50): error C2429: language feature 'init-statements in if/switch' requires compiler flag '/std:c++17'
1>C:\Users\mbell\Desktop\Cleo-main\Cleo\Anti.cpp(45,50): error C2429: language feature 'init-statements in if/switch' requires compiler flag '/std:c++17'
1>C:\Users\mbell\Desktop\Cleo-main\Cleo\Anti.cpp(48,49): error C2429: language feature 'init-statements in if/switch' requires compiler flag '/std:c++17'
1>C:\Users\mbell\Desktop\Cleo-main\Cleo\Anti.cpp(51,54): error C2429: language feature 'init-statements in if/switch' requires compiler flag '/std:c++17'
1>C:\Users\mbell\Desktop\Cleo-main\Cleo\Anti.cpp(54,47): error C2429: language feature 'init-statements in if/switch' requires compiler flag '/std:c++17'
1>C:\Users\mbell\Desktop\Cleo-main\Cleo\Anti.cpp(57,49): error C2429: language feature 'init-statements in if/switch' requires compiler flag '/std:c++17'
1>C:\Users\mbell\Desktop\Cleo-main\Cleo\Anti.cpp(60,54): error C2429: language feature 'init-statements in if/switch' requires compiler flag '/std:c++17'
1>C:\Users\mbell\Desktop\Cleo-main\Cleo\Anti.cpp(65,1): error C2511: 'HANDLE Anti::find_process(const char *)': overloaded member function not found in 'Anti'
1>C:\Users\mbell\Desktop\Cleo-main\Cleo\Anti.h(12): message : see declaration of 'Anti'
1>C:\Users\mbell\Desktop\Cleo-main\Cleo\Anti.cpp(72,6): error C2664: 'int strcmp(const char *,const char *)': cannot convert argument 1 from 'WCHAR [260]' to 'const char *'
1>C:\Users\mbell\Desktop\Cleo-main\Cleo\Anti.cpp(72,20): message : Types pointed to are unrelated; conversion requires reinterpret_cast, C-style cast or function-style cast
1>C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\ucrt\string.h(100,13): message : see declaration of 'strcmp'
1>C:\Users\mbell\Desktop\Cleo-main\Cleo\Anti.cpp(74,87): error C2429: language feature 'init-statements in if/switch' requires compiler flag '/std:c++17'
1>C:\Users\mbell\Desktop\Cleo-main\Cleo\Anti.cpp(91,5): error C2664: 'LSTATUS RegOpenKeyExW(HKEY,LPCWSTR,DWORD,REGSAM,PHKEY)': cannot convert argument 2 from 'ay::obfuscated_data<26,6531858508656880489>' to 'LPCWSTR'
1>C:\Users\mbell\Desktop\Cleo-main\Cleo\Anti.cpp(91,39): message : No user-defined-conversion operator available that can perform this conversion, or the operator cannot be called
1>C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\um\winreg.h(781,1): message : see declaration of 'RegOpenKeyExW'
1>C:\Users\mbell\Desktop\Cleo-main\Cleo\Anti.cpp(95,5): error C2664: 'LSTATUS RegOpenKeyExW(HKEY,LPCWSTR,DWORD,REGSAM,PHKEY)': cannot convert argument 2 from 'ay::obfuscated_data<52,6531858508656880489>' to 'LPCWSTR'
1>C:\Users\mbell\Desktop\Cleo-main\Cleo\Anti.cpp(95,39): message : No user-defined-conversion operator available that can perform this conversion, or the operator cannot be called
1>C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\um\winreg.h(781,1): message : see declaration of 'RegOpenKeyExW'
1>C:\Users\mbell\Desktop\Cleo-main\Cleo\Anti.cpp(100,5): error C2664: 'LSTATUS RegOpenKeyExW(HKEY,LPCWSTR,DWORD,REGSAM,PHKEY)': cannot convert argument 2 from 'ay::obfuscated_data<14,6531858508656880489>' to 'LPCWSTR'
1>C:\Users\mbell\Desktop\Cleo-main\Cleo\Anti.cpp(100,39): message : No user-defined-conversion operator available that can perform this conversion, or the operator cannot be called
1>C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\um\winreg.h(781,1): message : see declaration of 'RegOpenKeyExW'
1>C:\Users\mbell\Desktop\Cleo-main\Cleo\Anti.cpp(108,39): error C2429: language feature 'init-statements in if/switch' requires compiler flag '/std:c++17'
1>C:\Users\mbell\Desktop\Cleo-main\Cleo\Anti.cpp(122,31): error C2429: language feature 'init-statements in if/switch' requires compiler flag '/std:c++17'
1>C:\Users\mbell\Desktop\Cleo-main\Cleo\Anti.cpp(169,77): error C2429: language feature 'init-statements in if/switch' requires compiler flag '/std:c++17'
1>C:\Users\mbell\Desktop\Cleo-main\Cleo\Anti.cpp(173,46): error C3861: '__readfsdword': identifier not found
1>C:\Users\mbell\Desktop\Cleo-main\Cleo\Anti.cpp(174,14): error C2737: '_peb32': const object must be initialized
1>C:\Users\mbell\Desktop\Cleo-main\Cleo\Anti.cpp(175,63): warning C4312: 'reinterpret_cast': conversion from 'DWORD' to 'PDWORD' of greater size
1>C:\Users\mbell\Desktop\Cleo-main\Cleo\Anti.cpp(178,42): error C3861: '__readfsdword': identifier not found
1>C:\Users\mbell\Desktop\Cleo-main\Cleo\Anti.cpp(184,87): error C2429: language feature 'init-statements in if/switch' requires compiler flag '/std:c++17'
1>C:\Users\mbell\Desktop\Cleo-main\Cleo\Anti.cpp(190,58): error C2664: 'HMODULE GetModuleHandleW(LPCWSTR)': cannot convert argument 1 from 'const char [13]' to 'LPCWSTR'
1>C:\Users\mbell\Desktop\Cleo-main\Cleo\Anti.cpp(190,44): message : Types pointed to are unrelated; conversion requires reinterpret_cast, C-style cast or function-style cast
1>C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\um\libloaderapi.h(269,1): message : see declaration of 'GetModuleHandleW'
1>C:\Users\mbell\Desktop\Cleo-main\Cleo\Anti.cpp(190,16): error C2737: 'hKernel32': const object must be initialized
1>C:\Users\mbell\Desktop\Cleo-main\Cleo\Anti.cpp(218,8): error C2664: 'int strcmp(const char *,const char *)': cannot convert argument 1 from 'WCHAR [260]' to 'const char *'
1>C:\Users\mbell\Desktop\Cleo-main\Cleo\Anti.cpp(218,22): message : Types pointed to are unrelated; conversion requires reinterpret_cast, C-style cast or function-style cast
1>C:\Program Files (x86)\Windows Kits\10\Include\10.0.19041.0\ucrt\string.h(100,13): message : see declaration of 'strcmp'
1>C:\Users\mbell\Desktop\Cleo-main\Cleo\Anti.cpp(220,89): error C2429: language feature 'init-statements in if/switch' requires compiler flag '/std:c++17'
1>Main.cpp
1>C:\Users\mbell\Desktop\Cleo-main\Cleo\Modules.h(3,10): fatal error C1083: Cannot open include file: 'cpr/cpr.h': No such file or directory
1>User.cpp
1>The contents of are available only with C++17 or later.
1>C:\Users\mbell\Desktop\Cleo-main\Cleo\User.h(5,10): fatal error C1083: Cannot open include file: 'cpr/cpr.h': No such file or directory
1>Done building project "Cleo.vcxproj" -- FAILED.
========== Build: 0 succeeded, 1 failed, 0 up-to-date, 0 skipped ==========

I am running Windows version (x) and my specs are (...)
Windows 10 21H2 I5 4570 16GB Ram MSI GT 1030 GPU
I compiled with the build configuration (x) and am using the IDE (x)
x64 Idk IDE
(extra information)

In order to reproduce this problem you must, (x).