{"id":20086048,"url":"https://github.com/brosck/frosty","last_synced_at":"2025-10-28T09:19:05.488Z","repository":{"id":206818030,"uuid":"704707185","full_name":"brosck/Frosty","owner":"brosck","description":"「🧊」Ring 3 Rootkit for Windows 10","archived":false,"fork":false,"pushed_at":"2024-12-07T01:53:32.000Z","size":435,"stargazers_count":59,"open_issues_count":0,"forks_count":17,"subscribers_count":4,"default_branch":"main","last_synced_at":"2025-04-02T11:53:48.920Z","etag":null,"topics":["dll","frosty","malware","ring3","rootkit","service","windows"],"latest_commit_sha":null,"homepage":"","language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/brosck.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-10-13T21:52:10.000Z","updated_at":"2025-01-22T08:08:42.000Z","dependencies_parsed_at":"2023-11-25T02:29:31.418Z","dependency_job_id":"354074b6-dfb0-4d0b-8594-9259fa64d269","html_url":"https://github.com/brosck/Frosty","commit_stats":null,"previous_names":["mrempy/frosty","brosck/frosty"],"tags_count":2,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/brosck%2FFrosty","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/brosck%2FFrosty/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/brosck%2FFrosty/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/brosck%2FFrosty/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/brosck","download_url":"https://codeload.github.com/brosck/Frosty/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248075881,"owners_count":21043660,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["dll","frosty","malware","ring3","rootkit","service","windows"],"created_at":"2024-11-13T16:00:08.713Z","updated_at":"2025-10-28T09:19:05.423Z","avatar_url":"https://github.com/brosck.png","language":"C","funding_links":["https://www.buymeacoffee.com/mrempy"],"categories":[],"sub_categories":[],"readme":"\u003ch1 align=\"center\"\u003e「🧊」 About Frosty\u003c/h1\u003e\r\n\r\n\u003cp align=\"center\"\u003e\u003cimg src=\"Assets/banner.png\"\u003e\u003c/p\u003e\r\n\r\nFrosty is a sophisticated rootkit malware developed specifically for Windows operating systems, with an emphasis on its compatibility and effectiveness with Windows 10.\r\n\r\nA notable feature of Frosty is its use of Microsoft's Detours library. This strategic choice allows the malware to engage the Windows Native API (NTAPI), the application programming interfaces essential to the operating system's functions. Manipulating NTAPI allows Frosty to bypass conventional security measures and avoid detection by traditional methods.\r\n\r\n## Features\r\n\r\n* Hide Processes\r\n* Hide Services\r\n* Hide Directory\r\n* AMSI Bypass\r\n\r\n## Install\r\n\r\n### Requirements\r\n\r\n* Operating System: Windows 10.\r\n* Software: Microsoft Visual Studio 2022.\r\n* Tools, Compilers: MSVC v143 Build Tools, C++ Build Insights, MSBuild.exe.\r\n\r\n### Commands\r\n\r\n```\r\ngit clone https://github.com/brosck/Frosty.git\r\ncd Frosty\r\nnotepad config.h # customize the macros\r\n.\\builder.ps1 (x64 or x86)\r\nls build/\r\n```\r\n\r\nExecute the `build/Deployer.exe` file to automatically deploy the rootkit to the machine and execute `build/Uninstall.exe` on the machine to uninstall the Frosty rootkit.\r\n\r\n## PoC Video\r\n\r\n[![](https://img.youtube.com/vi/Ji12eh6LR78/0.jpg)](https://www.youtube.com/watch?v=Ji12eh6LR78)\r\n\r\n## Note\r\n\r\nThe Frosty rootkit is in its early development phase, so we are in beta. We welcome feedback on the rootkit so we can improve it.\r\n\r\nThis is one of my ambitious projects, as much as it is a ring 3 rootkit, it was a project in which I learned more internally about the Windows operating system. So if you find any bugs, please report them in `issues` so we can reach a final point and fix them.\r\n\r\n## Changelog (v0.2b)\r\n\r\n* Added suffix that allow user to customize their settings.\r\n* New macro in `config.h` called `RK_SERVICE_DESCRIPTION` used to set the service description (if you want to change it).\r\n* Hook the `AmsiScanBuffer` function from `amsi.dll` for evasion.\r\n\r\n## Buy me a coffee?\r\n\r\n\u003ca href=\"https://pixgg.com/MrEmpy\" target=\"_blank\"\u003e\r\n  \u003cimg src=\"https://pixgg.com/img/logo-darkmode.046d3b61.svg\" height=\"30\" widght=\"30\"\u003e\r\n\u003c/a\u003e\r\n\u003c/br\u003e\r\n\u003c/br\u003e\r\n\u003ca href=\"https://www.buymeacoffee.com/mrempy\" target=\"_blank\"\u003e\r\n  \u003cimg src=\"https://play-lh.googleusercontent.com/aMb_Qiolzkq8OxtQZ3Af2j8Zsp-ZZcNetR9O4xSjxH94gMA5c5gpRVbpg-3f_0L7vlo\" height=\"50\" widght=\"50\"\u003e\r\n\u003c/a\u003e\r\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbrosck%2Ffrosty","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fbrosck%2Ffrosty","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbrosck%2Ffrosty/lists"}