Python-Backdoor icon indicating copy to clipboard operation
Python-Backdoor copied to clipboard

Feature Request: Masking the program in task manager

Open RushilKoul opened this issue 3 years ago • 12 comments

A really cool feature would be having an ability to hide the program in the task manager, or change the process name and/or icon to something else. Right now, A user can easily disable the backdoor by simply using the task manager.

RushilKoul avatar Jun 06 '21 15:06 RushilKoul

There is no way to hide a process from task manager, but there might be something else. Il look into it later.

xp4xbox avatar Jun 08 '21 14:06 xp4xbox

Or is there?

Hawkern avatar Jul 10 '21 01:07 Hawkern

Not possible.

xp4xbox avatar Jul 10 '21 02:07 xp4xbox

It is possible to give a custom icon using pyinstaller and giving a fake name which really looks like an initial componnet like Google service handler, explorer.exe or something like that

imhemish avatar Aug 06 '21 15:08 imhemish

Yeah, in the setup use the melt file option, and then pick an icon.

xp4xbox avatar Aug 06 '21 16:08 xp4xbox

only thing I thought of is registering it as a service which will hide it from taskmanager task tab (would only be visible in taskmanager services tab) and it wont show on startup tab

gratisCobalt avatar Jan 13 '22 07:01 gratisCobalt

I will look into it.

xp4xbox avatar Jan 13 '22 15:01 xp4xbox

Can we migrate the process like in meterpreter

Hasham14 avatar Feb 10 '22 11:02 Hasham14

Can we migrate the process like in meterpreter

Forgot to respond to this, but no it is not possible, since migrating the process works by basically writing the payload into the process (would need to be able to have this work as shellcode)

xp4xbox avatar May 04 '22 00:05 xp4xbox

only thing I thought of is registering it as a service which will hide it from taskmanager task tab (would only be visible in taskmanager services tab) and it wont show on startup tab

I looked into this earlier, it is not possible without admin at least.

xp4xbox avatar May 04 '22 00:05 xp4xbox

Leaving it open incase there is another idea.

xp4xbox avatar May 04 '22 00:05 xp4xbox

just an idea... you could inject it into an unsuspicious process like e.g. notepad (in taskmanager it should show the process as e.g. notepad.exe) but maybe it will lead into getting detected easier

gratisCobalt avatar Jun 21 '22 22:06 gratisCobalt