{"id":17371818,"url":"https://github.com/sergilopez/flanders-trojan","last_synced_at":"2025-07-06T14:05:44.570Z","repository":{"id":225534885,"uuid":"766232266","full_name":"sergiLopez/Flanders-Trojan","owner":"sergiLopez","description":"Trojan written in C++ for Windows","archived":false,"fork":false,"pushed_at":"2024-03-12T19:56:19.000Z","size":1538,"stargazers_count":18,"open_issues_count":0,"forks_count":8,"subscribers_count":3,"default_branch":"main","last_synced_at":"2025-07-06T14:05:42.736Z","etag":null,"topics":["c-plus-plus","c2-server","command-and-control","ddos","debugger-detection","dll-injection","keylogger","malware","persistence","privilege-escalation","ransomware","screen-capture","trojan","uac-bypass","vm-detection","windows"],"latest_commit_sha":null,"homepage":"","language":"C++","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/sergiLopez.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-03-02T17:39:18.000Z","updated_at":"2025-05-29T18:45:06.000Z","dependencies_parsed_at":"2024-11-08T09:04:26.756Z","dependency_job_id":"a77a28f4-fb20-403e-9331-f4269084bcb5","html_url":"https://github.com/sergiLopez/Flanders-Trojan","commit_stats":{"total_commits":9,"total_committers":2,"mean_commits":4.5,"dds":0.4444444444444444,"last_synced_commit":"d42840ff452f5a374380cb0675665634e2421173"},"previous_names":["sergilopez/flanders-trojan"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/sergiLopez/Flanders-Trojan","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sergiLopez%2FFlanders-Trojan","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sergiLopez%2FFlanders-Trojan/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sergiLopez%2FFlanders-Trojan/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sergiLopez%2FFlanders-Trojan/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/sergiLopez","download_url":"https://codeload.github.com/sergiLopez/Flanders-Trojan/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sergiLopez%2FFlanders-Trojan/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":263914455,"owners_count":23529077,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["c-plus-plus","c2-server","command-and-control","ddos","debugger-detection","dll-injection","keylogger","malware","persistence","privilege-escalation","ransomware","screen-capture","trojan","uac-bypass","vm-detection","windows"],"created_at":"2024-10-16T01:05:18.018Z","updated_at":"2025-07-06T14:05:44.552Z","avatar_url":"https://github.com/sergiLopez.png","language":"C++","funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003cdiv align=\"center\"\u003e\n  \n# :warning: **WARNING** :warning:\n\n## This project is for academic purposes only. \nThe methods used within this project should not be utilized for illegal or unethical activities. Please use responsibly!\n\n\n\n\u003cdiv align=\"center\"\u003e\n  \u003cimg src=\"Flanders-Trojan.png\" width=\"40%\" /\u003e\n\u003c/div\u003e\n\n\n\u003c/div\u003e\n\n---\n\n\u003cdiv align=\"center\"\u003e\n  \n# The Origin\n\n\u003c/div\u003e\n\nThe Flanders trojan was developed for my computer engineering final thesis, driven by a curiosity for cybersecurity and a desire to delve deeper into operating system knowledge. It is developed specifically for Windows using C++, showcasing a blend of technical challenge and academic exploration.  \nFlanders, a character from The Simpsons, is known for his peaceful and innocent nature. However, this character harbors something dark within him. This behavior perfectly defines how the developed trojan operates, hence the name.\n\n---\n\n\u003cdiv align=\"center\"\u003e\n  \n# Components\n\n\u003c/div\u003e\n\nThe Flanders trojan is primarily composed of three components, each playing a pivotal role in its operation:\n\n### LOADER\n\nThe Loader is the initial component, responsible for setting the stage for the trojan's activities. Its functionalities include:\n\n- **VM Detection**: Identifying virtual machines through hypervisor signature.\n- **Debugging Detection**: Utilizing `NtQueryInformationProcess` to detect debugging environments.\n- **Privilege Escalation**: Bypassing User Account Control (UAC) to gain higher privileges.\n- **Persistence**: Achieving persistence through Windows Registry modifications or Scheduled Tasks.\n- **DLL Injection**: Injecting the payload, a DLL file, into `explorer.exe`.\n\n### PAYLOAD\n\nFollowing the Loader, the Payload component is responsible for executing a series of malicious actions:\n\n- **File Encryption**: Utilizing AES encryption to lock files.\n- **Keylogging**: Recording keystrokes to capture sensitive information.\n- **Screen Capturing**: Taking screenshots to monitor user activity.\n- **Command Execution**: Running malicious commands or scripts.\n- **DDoS Attack**: Launching HTTP flood attacks to disrupt targeted services.\n\nThis payload communicates with a server to send victim information, further facilitating malicious operations.\n\n### SERVER\n\nThe Server acts as the command and control (C2) center for the Flanders trojan:\n\n- **Receiving Requests**: Handling incoming communications from victim machines.\n- **Management**: Orchestrating the network of infected devices, effectively creating a botnet for coordinated attacks or information theft.\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsergilopez%2Fflanders-trojan","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsergilopez%2Fflanders-trojan","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsergilopez%2Fflanders-trojan/lists"}