Audit Log
- Unsafe DLL Loading (RCE Risk)
The client loads any DLL the server sends, without checking if it’s safe.
This means an attacker who reaches the server can send their own DLL and run code on the client machine.
Fix: Only load signed DLLs, or remove this feature.
- Weak Login / No Real Authentication
The client and subsockets use a hardcoded password (mooom825 )
There’s no random challenge, no session key, and no replay protection.
Anyone who knows the port can pretend to be a client or server.
Fix: Add a proper handshake with random data and verify it using HMAC or a public/private key.
- Encryption Is Broken
The key is hardcoded and the IV is always zero.
This makes all traffic easy to decrypt and lets attackers see repeated patterns.
Fix: Use TLS or at least random IVs and per-session keys.
- Startup Is Easy to Spot
Persistence uses names like XenoUpdateManager, which antivirus tools already flag.
Paths and mutex names are also predictable.
Fix: Randomize names/paths each build. Obfuscate strings.
- HWID Is Easy to Fake
HWID is based on basic info like username and CPU count, which can match on many systems.
Fix: Use more unique system info (e.g., BIOS UUID).
- Crash Logs Leak Info
If the client crashes, it sends the full error message and stack trace to the server before restarting.
This can leak paths and other private details.
Fix: Remove crash logging in release builds.
- Keylogger Has Stability Issues
The keylogger uses a low level keyboard hook.
If it doesn’t unhook correctly or if the pipe breaks, the client can crash.
Fix: Add better error handling and unique pipe names.
- Opcode Handling Has No Safety Checks
Incoming packets aren’t checked for minimum size.
An attacker can send a tiny packet and trigger invalid operations like restart or uninstall.
Fix: Verify packet sizes before reading them.
- Info Leak on Connect
When a client connects, it sends HWID, username, AV list, Windows version, and admin status automatically.
Fix: Only send info when needed and secure the encryption first.
- Compression Can Be Abused
The decompress function trusts the size sent by the sender.
An attacker can claim the original size is huge and crash the client (
Fix: Add limits for max allowed size.
Audit Log
The client loads any DLL the server sends, without checking if it’s safe.
This means an attacker who reaches the server can send their own DLL and run code on the client machine.
Fix: Only load signed DLLs, or remove this feature.
The client and subsockets use a hardcoded password (mooom825 )
There’s no random challenge, no session key, and no replay protection.
Anyone who knows the port can pretend to be a client or server.
Fix: Add a proper handshake with random data and verify it using HMAC or a public/private key.
The key is hardcoded and the IV is always zero.
This makes all traffic easy to decrypt and lets attackers see repeated patterns.
Fix: Use TLS or at least random IVs and per-session keys.
Persistence uses names like XenoUpdateManager, which antivirus tools already flag.
Paths and mutex names are also predictable.
Fix: Randomize names/paths each build. Obfuscate strings.
HWID is based on basic info like username and CPU count, which can match on many systems.
Fix: Use more unique system info (e.g., BIOS UUID).
If the client crashes, it sends the full error message and stack trace to the server before restarting.
This can leak paths and other private details.
Fix: Remove crash logging in release builds.
The keylogger uses a low level keyboard hook.
If it doesn’t unhook correctly or if the pipe breaks, the client can crash.
Fix: Add better error handling and unique pipe names.
Incoming packets aren’t checked for minimum size.
An attacker can send a tiny packet and trigger invalid operations like restart or uninstall.
Fix: Verify packet sizes before reading them.
When a client connects, it sends HWID, username, AV list, Windows version, and admin status automatically.
Fix: Only send info when needed and secure the encryption first.
The decompress function trusts the size sent by the sender.
An attacker can claim the original size is huge and crash the client (
Fix: Add limits for max allowed size.