Key fingerprint 9EF0 C41A FBA5 64AA 650A 0259 9C6D CD17 283E 454C
-----BEGIN PGP PUBLIC KEY BLOCK----- mQQBBGBjDtIBH6DJa80zDBgR+VqlYGaXu5bEJg9HEgAtJeCLuThdhXfl5Zs32RyB I1QjIlttvngepHQozmglBDmi2FZ4S+wWhZv10bZCoyXPIPwwq6TylwPv8+buxuff B6tYil3VAB9XKGPyPjKrlXn1fz76VMpuTOs7OGYR8xDidw9EHfBvmb+sQyrU1FOW aPHxba5lK6hAo/KYFpTnimsmsz0Cvo1sZAV/EFIkfagiGTL2J/NhINfGPScpj8LB bYelVN/NU4c6Ws1ivWbfcGvqU4lymoJgJo/l9HiV6X2bdVyuB24O3xeyhTnD7laf epykwxODVfAt4qLC3J478MSSmTXS8zMumaQMNR1tUUYtHCJC0xAKbsFukzbfoRDv m2zFCCVxeYHvByxstuzg0SurlPyuiFiy2cENek5+W8Sjt95nEiQ4suBldswpz1Kv n71t7vd7zst49xxExB+tD+vmY7GXIds43Rb05dqksQuo2yCeuCbY5RBiMHX3d4nU 041jHBsv5wY24j0N6bpAsm/s0T0Mt7IO6UaN33I712oPlclTweYTAesW3jDpeQ7A ioi0CMjWZnRpUxorcFmzL/Cc/fPqgAtnAL5GIUuEOqUf8AlKmzsKcnKZ7L2d8mxG QqN16nlAiUuUpchQNMr+tAa1L5S1uK/fu6thVlSSk7KMQyJfVpwLy6068a1WmNj4 yxo9HaSeQNXh3cui+61qb9wlrkwlaiouw9+bpCmR0V8+XpWma/D/TEz9tg5vkfNo eG4t+FUQ7QgrrvIkDNFcRyTUO9cJHB+kcp2NgCcpCwan3wnuzKka9AWFAitpoAwx L6BX0L8kg/LzRPhkQnMOrj/tuu9hZrui4woqURhWLiYi2aZe7WCkuoqR/qMGP6qP EQRcvndTWkQo6K9BdCH4ZjRqcGbY1wFt/qgAxhi+uSo2IWiM1fRI4eRCGifpBtYK Dw44W9uPAu4cgVnAUzESEeW0bft5XXxAqpvyMBIdv3YqfVfOElZdKbteEu4YuOao FLpbk4ajCxO4Fzc9AugJ8iQOAoaekJWA7TjWJ6CbJe8w3thpznP0w6jNG8ZleZ6a jHckyGlx5wzQTRLVT5+wK6edFlxKmSd93jkLWWCbrc0Dsa39OkSTDmZPoZgKGRhp Yc0C4jePYreTGI6p7/H3AFv84o0fjHt5fn4GpT1Xgfg+1X/wmIv7iNQtljCjAqhD 6XN+QiOAYAloAym8lOm9zOoCDv1TSDpmeyeP0rNV95OozsmFAUaKSUcUFBUfq9FL uyr+rJZQw2DPfq2wE75PtOyJiZH7zljCh12fp5yrNx6L7HSqwwuG7vGO4f0ltYOZ dPKzaEhCOO7o108RexdNABEBAAG0Rldpa2lMZWFrcyBFZGl0b3JpYWwgT2ZmaWNl IEhpZ2ggU2VjdXJpdHkgQ29tbXVuaWNhdGlvbiBLZXkgKDIwMjEtMjAyNCmJBDEE EwEKACcFAmBjDtICGwMFCQWjmoAFCwkIBwMFFQoJCAsFFgIDAQACHgECF4AACgkQ nG3NFyg+RUzRbh+eMSKgMYOdoz70u4RKTvev4KyqCAlwji+1RomnW7qsAK+l1s6b ugOhOs8zYv2ZSy6lv5JgWITRZogvB69JP94+Juphol6LIImC9X3P/bcBLw7VCdNA mP0XQ4OlleLZWXUEW9EqR4QyM0RkPMoxXObfRgtGHKIkjZYXyGhUOd7MxRM8DBzN yieFf3CjZNADQnNBk/ZWRdJrpq8J1W0dNKI7IUW2yCyfdgnPAkX/lyIqw4ht5UxF VGrva3PoepPir0TeKP3M0BMxpsxYSVOdwcsnkMzMlQ7TOJlsEdtKQwxjV6a1vH+t k4TpR4aG8fS7ZtGzxcxPylhndiiRVwdYitr5nKeBP69aWH9uLcpIzplXm4DcusUc Bo8KHz+qlIjs03k8hRfqYhUGB96nK6TJ0xS7tN83WUFQXk29fWkXjQSp1Z5dNCcT sWQBTxWxwYyEI8iGErH2xnok3HTyMItdCGEVBBhGOs1uCHX3W3yW2CooWLC/8Pia qgss3V7m4SHSfl4pDeZJcAPiH3Fm00wlGUslVSziatXW3499f2QdSyNDw6Qc+chK hUFflmAaavtpTqXPk+Lzvtw5SSW+iRGmEQICKzD2chpy05mW5v6QUy+G29nchGDD rrfpId2Gy1VoyBx8FAto4+6BOWVijrOj9Boz7098huotDQgNoEnidvVdsqP+P1RR QJekr97idAV28i7iEOLd99d6qI5xRqc3/QsV+y2ZnnyKB10uQNVPLgUkQljqN0wP XmdVer+0X+aeTHUd1d64fcc6M0cpYefNNRCsTsgbnWD+x0rjS9RMo+Uosy41+IxJ 6qIBhNrMK6fEmQoZG3qTRPYYrDoaJdDJERN2E5yLxP2SPI0rWNjMSoPEA/gk5L91 m6bToM/0VkEJNJkpxU5fq5834s3PleW39ZdpI0HpBDGeEypo/t9oGDY3Pd7JrMOF zOTohxTyu4w2Ql7jgs+7KbO9PH0Fx5dTDmDq66jKIkkC7DI0QtMQclnmWWtn14BS KTSZoZekWESVYhORwmPEf32EPiC9t8zDRglXzPGmJAPISSQz+Cc9o1ipoSIkoCCh 2MWoSbn3KFA53vgsYd0vS/+Nw5aUksSleorFns2yFgp/w5Ygv0D007k6u3DqyRLB W5y6tJLvbC1ME7jCBoLW6nFEVxgDo727pqOpMVjGGx5zcEokPIRDMkW/lXjw+fTy c6misESDCAWbgzniG/iyt77Kz711unpOhw5aemI9LpOq17AiIbjzSZYt6b1Aq7Wr aB+C1yws2ivIl9ZYK911A1m69yuUg0DPK+uyL7Z86XC7hI8B0IY1MM/MbmFiDo6H dkfwUckE74sxxeJrFZKkBbkEAQRgYw7SAR+gvktRnaUrj/84Pu0oYVe49nPEcy/7 5Fs6LvAwAj+JcAQPW3uy7D7fuGFEQguasfRrhWY5R87+g5ria6qQT2/Sf19Tpngs d0Dd9DJ1MMTaA1pc5F7PQgoOVKo68fDXfjr76n1NchfCzQbozS1HoM8ys3WnKAw+ Neae9oymp2t9FB3B+To4nsvsOM9KM06ZfBILO9NtzbWhzaAyWwSrMOFFJfpyxZAQ 8VbucNDHkPJjhxuafreC9q2f316RlwdS+XjDggRY6xD77fHtzYea04UWuZidc5zL VpsuZR1nObXOgE+4s8LU5p6fo7jL0CRxvfFnDhSQg2Z617flsdjYAJ2JR4apg3Es G46xWl8xf7t227/0nXaCIMJI7g09FeOOsfCmBaf/ebfiXXnQbK2zCbbDYXbrYgw6 ESkSTt940lHtynnVmQBvZqSXY93MeKjSaQk1VKyobngqaDAIIzHxNCR941McGD7F qHHM2YMTgi6XXaDThNC6u5msI1l/24PPvrxkJxjPSGsNlCbXL2wqaDgrP6LvCP9O uooR9dVRxaZXcKQjeVGxrcRtoTSSyZimfjEercwi9RKHt42O5akPsXaOzeVjmvD9 EB5jrKBe/aAOHgHJEIgJhUNARJ9+dXm7GofpvtN/5RE6qlx11QGvoENHIgawGjGX Jy5oyRBS+e+KHcgVqbmV9bvIXdwiC4BDGxkXtjc75hTaGhnDpu69+Cq016cfsh+0 XaRnHRdh0SZfcYdEqqjn9CTILfNuiEpZm6hYOlrfgYQe1I13rgrnSV+EfVCOLF4L P9ejcf3eCvNhIhEjsBNEUDOFAA6J5+YqZvFYtjk3efpM2jCg6XTLZWaI8kCuADMu yrQxGrM8yIGvBndrlmmljUqlc8/Nq9rcLVFDsVqb9wOZjrCIJ7GEUD6bRuolmRPE SLrpP5mDS+wetdhLn5ME1e9JeVkiSVSFIGsumZTNUaT0a90L4yNj5gBE40dvFplW 7TLeNE/ewDQk5LiIrfWuTUn3CqpjIOXxsZFLjieNgofX1nSeLjy3tnJwuTYQlVJO 3CbqH1k6cOIvE9XShnnuxmiSoav4uZIXnLZFQRT9v8UPIuedp7TO8Vjl0xRTajCL PdTk21e7fYriax62IssYcsbbo5G5auEdPO04H/+v/hxmRsGIr3XYvSi4ZWXKASxy a/jHFu9zEqmy0EBzFzpmSx+FrzpMKPkoU7RbxzMgZwIYEBk66Hh6gxllL0JmWjV0 iqmJMtOERE4NgYgumQT3dTxKuFtywmFxBTe80BhGlfUbjBtiSrULq59np4ztwlRT wDEAVDoZbN57aEXhQ8jjF2RlHtqGXhFMrg9fALHaRQARAQABiQQZBBgBCgAPBQJg Yw7SAhsMBQkFo5qAAAoJEJxtzRcoPkVMdigfoK4oBYoxVoWUBCUekCg/alVGyEHa ekvFmd3LYSKX/WklAY7cAgL/1UlLIFXbq9jpGXJUmLZBkzXkOylF9FIXNNTFAmBM 3TRjfPv91D8EhrHJW0SlECN+riBLtfIQV9Y1BUlQthxFPtB1G1fGrv4XR9Y4TsRj VSo78cNMQY6/89Kc00ip7tdLeFUHtKcJs+5EfDQgagf8pSfF/TWnYZOMN2mAPRRf fh3SkFXeuM7PU/X0B6FJNXefGJbmfJBOXFbaSRnkacTOE9caftRKN1LHBAr8/RPk pc9p6y9RBc/+6rLuLRZpn2W3m3kwzb4scDtHHFXXQBNC1ytrqdwxU7kcaJEPOFfC XIdKfXw9AQll620qPFmVIPH5qfoZzjk4iTH06Yiq7PI4OgDis6bZKHKyyzFisOkh DXiTuuDnzgcu0U4gzL+bkxJ2QRdiyZdKJJMswbm5JDpX6PLsrzPmN314lKIHQx3t NNXkbfHL/PxuoUtWLKg7/I3PNnOgNnDqCgqpHJuhU1AZeIkvewHsYu+urT67tnpJ AK1Z4CgRxpgbYA4YEV1rWVAPHX1u1okcg85rc5FHK8zh46zQY1wzUTWubAcxqp9K 1IqjXDDkMgIX2Z2fOA1plJSwugUCbFjn4sbT0t0YuiEFMPMB42ZCjcCyA1yysfAd DYAmSer1bq47tyTFQwP+2ZnvW/9p3yJ4oYWzwMzadR3T0K4sgXRC2Us9nPL9k2K5 TRwZ07wE2CyMpUv+hZ4ja13A/1ynJZDZGKys+pmBNrO6abxTGohM8LIWjS+YBPIq trxh8jxzgLazKvMGmaA6KaOGwS8vhfPfxZsu2TJaRPrZMa/HpZ2aEHwxXRy4nm9G Kx1eFNJO6Ues5T7KlRtl8gflI5wZCCD/4T5rto3SfG0s0jr3iAVb3NCn9Q73kiph PSwHuRxcm+hWNszjJg3/W+Fr8fdXAh5i0JzMNscuFAQNHgfhLigenq+BpCnZzXya 01kqX24AdoSIbH++vvgE0Bjj6mzuRrH5VJ1Qg9nQ+yMjBWZADljtp3CARUbNkiIg tUJ8IJHCGVwXZBqY4qeJc3h/RiwWM2UIFfBZ+E06QPznmVLSkwvvop3zkr4eYNez cIKUju8vRdW6sxaaxC/GECDlP0Wo6lH0uChpE3NJ1daoXIeymajmYxNt+drz7+pd jMqjDtNA2rgUrjptUgJK8ZLdOQ4WCrPY5pP9ZXAO7+mK7S3u9CTywSJmQpypd8hv 8Bu8jKZdoxOJXxj8CphK951eNOLYxTOxBUNB8J2lgKbmLIyPvBvbS1l1lCM5oHlw WXGlp70pspj3kaX4mOiFaWMKHhOLb+er8yh8jspM184= =5a6T -----END PGP PUBLIC KEY BLOCK-----
If you need help using Tor you can contact WikiLeaks for assistance in setting it up using our simple webchat available at: https://wikileaks.org/talk
If you can use Tor, but need to contact WikiLeaks for other reasons use our secured webchat available at http://wlchatc3pjwpli5r.onion
We recommend contacting us over Tor if you can.
Tor is an encrypted anonymising network that makes it harder to intercept internet communications, or see where communications are coming from or going to.
In order to use the WikiLeaks public submission system as detailed above you can download the Tor Browser Bundle, which is a Firefox-like browser available for Windows, Mac OS X and GNU/Linux and pre-configured to connect using the anonymising system Tor.
If you are at high risk and you have the capacity to do so, you can also access the submission system through a secure operating system called Tails. Tails is an operating system launched from a USB stick or a DVD that aim to leaves no traces when the computer is shut down after use and automatically routes your internet traffic through Tor. Tails will require you to have either a USB stick or a DVD at least 4GB big and a laptop or desktop computer.
Our submission system works hard to preserve your anonymity, but we recommend you also take some of your own precautions. Please review these basic guidelines.
If you have a very large submission, or a submission with a complex format, or are a high-risk source, please contact us. In our experience it is always possible to find a custom solution for even the most seemingly difficult situations.
If the computer you are uploading from could subsequently be audited in an investigation, consider using a computer that is not easily tied to you. Technical users can also use Tails to help ensure you do not leave any records of your submission on the computer.
If you have any issues talk to WikiLeaks. We are the global experts in source protection – it is a complex field. Even those who mean well often do not have the experience or expertise to advise properly. This includes other media organisations.
If you have any issues talk to WikiLeaks. We are the global experts in source protection – it is a complex field. Even those who mean well often do not have the experience or expertise to advise properly. This includes other media organisations.
If you are a high-risk source, avoid saying anything or doing anything after submitting which might promote suspicion. In particular, you should try to stick to your normal routine and behaviour.
If you are a high-risk source and the computer you prepared your submission on, or uploaded it from, could subsequently be audited in an investigation, we recommend that you format and dispose of the computer hard drive and any other storage media you used.
In particular, hard drives retain data after formatting which may be visible to a digital forensics team and flash media (USB sticks, memory cards and SSD drives) retain data even after a secure erasure. If you used flash media to store sensitive data, it is important to destroy the media.
If you do this and are a high-risk source you should make sure there are no traces of the clean-up, since such traces themselves may draw suspicion.
If a legal action is brought against you as a result of your submission, there are organisations that may help you. The Courage Foundation is an international organisation dedicated to the protection of journalistic sources. You can find more details at https://www.couragefound.org.
WikiLeaks publishes documents of political or historical importance that are censored or otherwise suppressed. We specialise in strategic global publishing and large archives.
The following is the address of our secure site where you can anonymously upload your documents to WikiLeaks editors. You can only access this submissions system through Tor. (See our Tor tab for more information.) We also advise you to read our tips for sources before submitting.
If you cannot use Tor, or your submission is very large, or you have specific requirements, WikiLeaks provides several alternative methods. Contact us to discuss how to proceed.
Navigation: » Directory » Remote Development Branch (RDB) » RDB Home » Umbrage
The UMBRAGE team maintains a library of application development techniques borrowed from in-the-wild malware. The goal of this repository is to provide functional code snippets that can be rapidly combined into custom solutions. Rather than building feature-rich tools, which are often costly and can have significant CI value, this effort focuses on developing smaller and more targeted solutions built to operational specifications.
This page organizes this collection based on its functionality and captures relevant technical information. When possible, each item should include a working example of the technique (and/or pointer to code in the SVN repository), documentation describing application of the technique, and notes concerning our use of these techniques in delivered tools.
The Umbrage Component Library git repository (located in Stash) contains example code for many of these techniques.
Component Reuse | Source | Reference | Description | |
---|---|---|---|---|
DirectInput Keylogger | None | Known Malware | Used the Microsoft DirectX APIApplication Programming Interface to collect keystrokes from any running application. | |
Internet Explorer Password Collection | None | Known Malware | ||
SetWindowsHookEx WH_KEYBOARD and WH_KEYBOARD_LL Key Logger | UNKL 1.0/2.x | Known Malware | MSDN | Microsoft-supported method of collecting keystrokes from applications running at the same or lower privilege level. |
Webcam Capture | None | Known Malware/Public Samples | ||
Windows API Keyloggers | None | Known Malware |
Component Reuse | Source | Reference | Description | |
---|---|---|---|---|
Wiped Locked Files | Rebound 1.0 | Shamoon | Drops a signed driver (with an easily abused license key) that provides raw disk access to the file system. |
Component Reuse | Source | Reference | Description | |
---|---|---|---|---|
Image File Execution Options | None | (Autoruns) | Registry key that was designed to assist with debugging and allows the user to specifiy an executable that should be run instead of the specified application. Lol. | |
OCI.DLL Service Persistence | None | HiKit Rootkit | DLL hijack. | |
Shell Extension Persistence | Stepstool | Public Source Sample | Abuses Windows Explorer shell extensions to provide persistence. | |
Windows FAX DLL Injection | Sandshark, UNKL | Known Malware | DLL hijack, notable because the original DLLDynamic Link Library is not typically required by the system. | |
TLS Library Injection | None | LL TLS | Modifies a Windows PEPrivilege Escalation file to include a TLSTransport Layer Security section that causes the specified DLLDynamic Link Library to be loaded. |
Component Reuse | Source | Reference | Description | |
---|---|---|---|---|
Elevated COM Object UAC Bypass (WIN 7) | Sandshark | Public Sample | Created an elevated COM file system object that can be used to manipulate files that would otherwise required UACUser Account Control approval. | |
Sticky Keys Process Launch | None | PIQUE 2014-10 Sticky Keys | Uses the image execution options registry key to redirect the "stick keys" hot-key combination to run an arbitrary executable. |
|
Sysprep UACUser Account Control Bypass using Process Injection | None | PIQUE 2014-11 Sysprep | Exploits DLLDynamic Link Library load order by dropping a DLLDynamic Link Library into the Sysprep folder then invoking the Sysprep utility to load it with elevation. | |
Windows File Protection Bypass using SFC | None | PIQUE 2014-11 Window File Protection | Uses the "sfc_os.dll" APIApplication Programming Interface to temporarily disable WFP and allow the replacement of system files. |
Component Reuse | Source | Reference | Description | |
---|---|---|---|---|
Anti-Sandboxing: Wait for Mouse Click emote DLLDynamic Link Library Injection via Mapping | Duggernaut, Shellfish | LL - Archimedes Loader | Directly maps a DLLDynamic Link Library into a remote process through a combination of writing to the remote process and forcing it to load library dependecies. | |
Remote DLLDynamic Link Library Injection via Reflection | None | LL - Odysseus Loader |
Injects a specially crafted DLLDynamic Link Library into a remote process and causes it to load itself. | |
Process Hollowing Implementation #0 | None | Known Malware |
|
|
Process Hollowing Implementation #1 | None | PIQUE 2014-10 Process Hollowing PIQUE 2014-12 Advanced Process Hollowing |
Starts a benign executable with suspended threads and replaces the address space with another executable before resuming the threads. | |
Process Hollowing #2 | None | PIQUE PoC | PIQUE 2015-09 "Process Hollowing II" |
Create a process (suspended), and then use section mapping to achieve the process hollowing |
Process Injection using SetWindowsLong | None | PIQUE 2014-10 Sticky Keys | Uses a callback function in the SetWindowsLong APIApplication Programming Interface to start a remote thread without using the CreateRemoteThread API. | |
DLL Memory Loading with Exception Support | Icepick, Shellfish | NPS 2012-11 | Memory loads a DLLDynamic Link Library into the current process and adds the new DLLDynamic Link Library to the inverted function table to support SEH exception handling. | |
Code Injection using ZwContinue |
None | PIQUE 2014-12 ZwContinue Injection | Hooks the ZwContinue APIApplication Programming Interface in a remote process to gain thread execution without calling CreateRemoteThread. |
|
DLL Hide & DLLDynamic Link Library file delete | None | PIQUE PoC | PIQUE 2015-09 "HIDE DLL" | Copies in-memory DLLDynamic Link Library image, decrements DLLDynamic Link Library ref count, frees then reallocates original DLLDynamic Link Library addy, then moves the copy back into the original memory location. |
Component Reuse | Source | Reference | Description | |
---|---|---|---|---|
Anti-Sandboxing: Wait for Mouse Click | None | Upclicker | Detects a "live" system by looking for clicks. | |
API Memcpy | None | Known Malware (Nuclear Exploit Pack) | ||
Debug Print Debugger Detection | None | Public Source Examples, FineReader | ||
MBR File Handle | StolenGoods | Known FIO Tool | ||
Run Out The Clock (PSP Avoidance) | None | Known Malware | Performs time-delaying operations that are difficult for a PSPPersonal Security Product (Anti-Virus) to optimize out. | |
API Obfuscation using Hashes | None | PIQUE 2014-10 Advanced Function Call Obfuscation | Enables an application to locate DLLs and exported functions via a hash of the APIApplication Programming Interface name. Used to obfuscate APIApplication Programming Interface calls. | |
Software Target Keying | None | NPS 2012-11 | Binds an application to a dynamically generated system key. | |
Disable System Tray Popups | None | PIQUE 2014-12 Disable AVAnti-Virus Popup | Disables the system tray's redraw message. Can be used to temporarily block messages from many system tray applications. |
Component Reuse | Source | Reference | Description | |
---|---|---|---|---|
NetBIOS MACApple Operating System Enumeration | None | PIQUE 2014-09 NetBIOS MAC |
Uses the NetBIOS APIApplication Programming Interface to enumerate the MACApple Operating System address of each adapter found on the target system. | |
File/Registry Change Notification | The Hound | PIQUE 2014-09 Persistence | Demonstrates the use of Windows APIApplication Programming Interface calls to monitor modifications to the file system or registry. |
Component Reuse | Source | Reference | Description | |
---|---|---|---|---|
Blind File Handle Enumeration | None | PIQUE 2014-10 File Handle Enumeration PIQUE 2014-11 Advanced File Handle Enumeration |
Tests each possible handle value to determine whether it is a Windows file handle and identifies the mapped file for valid handles. Can be used by code that is injected into a target process. |
2015-01-09 14:26 [User #524297]:
done, looks like you are on your way already though at the Stash link above.
2015-01-07 16:29 [User #1179891]:
User #524297 - I do not have access to the page you mentioned above. Do you mind giving us (the Umbrage team) read-only access to it so we can see how User #? layed it out?
2013-06-19 09:27 [User #524297]:
As far as Stash organization, I would recommend that you create one larger "Umbrage" project, and then create separate repositories within that project for each component. Then there is one central point on the site for 'all things Umbrage'. Check out how User #1179891 set up the iOS stuff: https://stash.devlan.net/projects/IOS
| 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 |