4 ms·
Here's the codeproject link the code came from. https://www.codeproject.com/Articles/17052/Self-Deleting-Executables#Whereartthou,Oh%20greatentrypointoftheremo
by 8organicbits 3y ago
Here's the codeproject link the code came from.
https://www.codeproject.com/Articles/17052/Self-Deleting-Executables#Whereartthou,Oh%20greatentrypointoftheremoteprocess2 https://www.codeproject.com/Articles/17052/Self-Deleting-Exe...
> Whether they follow the licensing terms for that code I do not know.
I'm guessing they didn't ship the binary with a link pointing back to this page?
These's also another codeproject example that uses a bat file, which is fairly similar to the recommendation in the post. I guess that's the better example.
https://www.codeproject.com/Articles/4027/Writing-a-self-destructing-exe-file https://www.codeproject.com/Articles/4027/Writing-a-self-des...
- xg15 3y agoAt least the author seems to agree with Raymond Chan on the similarities between his approach and malware... > shellcode is the technical term (in security circles) for binary machine code that is typically used in exploits as the payload. Here's a quick and dirty way of generating the shellcode from the obj file generated when you compile your source files. In our case, we are interested in whipping the shellcode up for the remote_thread routine. Here's what you've got to do: The whole article has the vibes of some questionable DIY blog along the lines of "Your house is infested by vermin? Here is an easy way to get rid of them using a small, homebuilt neutron bomb!"
- lloydatkinson 3y agoUnfortunatelt CodeProject is full of code like this.
- Arainach 3y agoNit: Raymond Chen, not Chan
- xg15 3y agoAh, I'm sorry. That happens when you write messages on the go... seems too late to edit the message though unfortunately.
- taway1237 3y agoFunnily enough, real malware does this correctly. Usually by just ShellExecing "ping -n 3 127.0.0.1 >nul" followed by "del" - no temporary file needed.