https://github.com/guitmz/vala-zariche

Linux.Zariche: a Vala virus
https://github.com/guitmz/vala-zariche

elf linux malware vala virus vx

Last synced: about 1 month ago
JSON representation

Linux.Zariche: a Vala virus

• Host: GitHub
• URL: https://github.com/guitmz/vala-zariche
• Owner: guitmz
• Created: 2015-04-14T20:59:35.000Z (over 9 years ago)
• Default Branch: master
• Last Pushed: 2015-04-28T18:05:40.000Z (over 9 years ago)
• Last Synced: 2023-02-26T07:06:47.651Z (almost 2 years ago)
• Topics: elf, linux, malware, vala, virus, vx
• Language: Vala
• Homepage: https://www.guitmz.com/vala-virus/
• Size: 145 KB
• Stars: 3
• Watchers: 1
• Forks: 0
• Open Issues: 0
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

README

        
# Linux.Zariche: a Vala virus

Vala is an object-oriented programming language with a self-hosting compiler that generates C code and uses the GObject system. Vala is syntactically similar to C# and and rather than being compiled directly to assembly or to another intermediate language, Vala is source-to-source compiled to C, which is then compiled with a platform's standard C compiler, such as GCC.

You can also create VAPI files which are basically native C (not C++) functions you can import to Vala code. Being a language that is converted into plain and pure C, Vala code can also run on Windows (with the necessary code optimizations, of course).

Anyway I was decided to write a prepender in this language, the first (binary) virus ever written so far in Vala. It's named Linux.Zariche and there are two variants available so far.

* Linux.Zariche.A original release, simple ELF infector (prepender).

* Linux.Zariche.B uses AES encryptation via external library (vapi).

Compilation instructions are the following (tested on a x86_64 system, but should work on x86):

**valac filename.vala --pkg=gee-1.0 --pkg=gio-2.0 --pkg=nettle --pkg=posix**

Where Vala >= 0.20. In order to use the --pkg=nettle flag, place your nettle.vapi file inside Vala's library folder, usually something like /usr/share/vala-0.20/vapi for example.

NOTE: I'm not responsible for any damages this code may cause, use at your own risk and in a safe environment.