Tetragrammaton Ritual App for Windows

As requested by Hermit of 13 Swords, here is the source code for the application: https://mega.nz/file/K6ZW2Z4R#LfPcwBuaIXQadlR-FaNIB-i5O8SjzIDaznyUBHJMiUs

Hermit of 13 Swords wrote:

Hi! Mind if i ask, can you do it as a open source code as you did before?

You see translation of Rituals and apps usually takes a while for us, because of that some Zevism that doesn't know english that well can get behind. So it would be easier for us to translate the app's content to our languages that way.

ShadowTheRaven wrote:

...

Program works. No malware (of course).

Is there a way to reset the blotting of the letters? Maybe I am missing something, but I thought the ritual calls for the blotting to occur multiple times.

Anyway, great work.

I appreciate the gesture of a virus scan, but that's not good enough. In 2014, I wrote a virus in VB.NET, and it still shows up as completely clean in every antivirus program I've tested. They are usually only reliable at detecting known viruses. If you write a virus with a pattern that hasn't been observed before, it will slip right through.

If possible, you should just post the source code.

For example, try scanning this one-liner:

IO.Directory.Delete(My.Computer.FileSystem.SpecialDirectories.MyDocuments, True)

That will delete the entire "My Documents" folder. I just compiled that line and scanned it with Jotti's Virus Scan and VirusTotal, and it got a perfect score of glowing green checkmarks! :shock: I doubt any antivirus program will catch it unless it monitors the filesystem constantly. :ugeek:

Legend!!! Thank you!

Blitzkreig wrote:

ShadowTheRaven wrote:

...

Program works. No malware (of course).

Is there a way to reset the blotting of the letters? Maybe I am missing something, but I thought the ritual calls for the blotting to occur multiple times.

Anyway, great work.

Close and reopen the program.

And from my understanding, aren't you supposed to blot each letter left to right, one at a time?

Would love to see an apk or a html based version. In the meantime this version is great. Thank you so much.

Soaring Eagle 666 wrote:

I appreciate the gesture of a virus scan, but that's not good enough. In 2014, I wrote a virus in VB.NET, and it still shows up as completely clean in every antivirus program I've tested. They are usually only reliable at detecting known viruses. If you write a virus with a pattern that hasn't been observed before, it will slip right through.

If possible, you should just post the source code.

I've already posted the source code, and if you think writing a script to delete the Documents folder is a virus, then buddy I've got news for you. People write viruses with a purpose, not just for childish pranks but for causing real fucking damage. How about a Trojan Horse that gains remote access to a banking firm's computer, uploads a worm that salami slices every transaction it makes, and transfers it all into a bitcoin wallet?

Or falsifying SWIFT details in order to send fraudulent account transfer requests from the New York Fed?

Or creating ransomware and infecting public medical systems, forcing them to completely wipe out every single patient's data and start all over from scratch, while potentially losing precious research on treatments for terminal illnesses, like Cancer.

If you think deleting My Documents is a virus, you aren't focusing on what a virus can actually do, but rather pranks you can play on your friends.

Soaring Eagle 666 wrote:

That will delete the entire "My Documents" folder. I just compiled that line and scanned it with Jotti's Virus Scan and VirusTotal, and it got a perfect score of glowing green checkmarks! :shock: I doubt any antivirus program will catch it unless it monitors the filesystem constantly. :ugeek:

What Antiviruses look for is a program that can take advantage of your computer's inner workings. Trojan Horses for example, like njRAT work by connecting your computer to a static DNS controlled by the hacker through a simple client/server setup.

Is it also worth mentioning that njRAT was coded in Visual Basic .NET?

https://www.youtube.com/watch?v=mZBeLFKvUis

Here's a Trojan Horse in action, from the hacker's side for instance.

What you're forgetting is that files can always be recovered. In fact, all Windows PCs with the Windows 2000 operating system and newer have this feature. Really the only way they couldn't be recovered is if you were somehow dumb enough to infect yourself with WannaCry.

ShadowTheRaven wrote:

Soaring Eagle 666 wrote:

I appreciate the gesture of a virus scan, but that's not good enough. In 2014, I wrote a virus in VB.NET, and it still shows up as completely clean in every antivirus program I've tested. They are usually only reliable at detecting known viruses. If you write a virus with a pattern that hasn't been observed before, it will slip right through.

If possible, you should just post the source code.

I've already posted the source code, and if you think writing a script to delete the Documents folder is a virus, then buddy I've got news for you. People write viruses with a purpose, not just for childish pranks but for causing real fucking damage. How about a Trojan Horse that gains remote access to a banking firm's computer, uploads a worm that salami slices every transaction it makes, and transfers it all into a bitcoin wallet?

Or falsifying SWIFT details in order to send fraudulent account transfer requests from the New York Fed?

Or creating ransomware and infecting public medical systems, forcing them to completely wipe out every single patient's data and start all over from scratch, while potentially losing precious research on treatments for terminal illnesses, like Cancer.

If you think deleting My Documents is a virus, you aren't focusing on what a virus can actually do, but rather pranks you can play on your friends.

Thanks for posting the source. Posts here take time to go through, and yours hadn't gone through yet when I asked.

Most people don't keep proper backups, so deleting the Documents folder can be a devastating loss. And how about ransomware, which you mentioned as a "real" virus? That simply involves encrypting instead of deleting. If you don't pay, then it's exactly the same as deletion! Regardless, the VB virus I mentioned writing is a full-fledged RAT that can evade every static antivirus I've tested. I actually wrote it with no malicious intent as an enhanced version of Remote Desktop. However, it could easily be packaged as a Trojan Horse to let me gain full control over the victim computer. Sometimes a real-time antivirus will catch the outgoing network connection, but a ransomware wouldn't even have that weakness.

My point is just that an online antivirus scan is only meaningful when it finds a virus.

Please, make an online trittagammaton ritual for Android, please.

After downloading the zip, what should I do?

This is excellent, thank you.

Mondol wrote:

After downloading the zip, what should I do?

Extract it using WinRAR.

Soaring Eagle 666 wrote:

Thanks for posting the source. Posts here take time to go through, and yours hadn't gone through yet when I asked.

Most people don't keep proper backups, so deleting the Documents folder can be a devastating loss. And how about ransomware, which you mentioned as a "real" virus? That simply involves encrypting instead of deleting. If you don't pay, then it's exactly the same as deletion! Regardless, the VB virus I mentioned writing is a full-fledged RAT that can evade every static antivirus I've tested. I actually wrote it with no malicious intent as an enhanced version of Remote Desktop. However, it could easily be packaged as a Trojan Horse to let me gain full control over the victim computer. Sometimes a real-time antivirus will catch the outgoing network connection, but a ransomware wouldn't even have that weakness.

My point is just that an online antivirus scan is only meaningful when it finds a virus.

I understand that and I apologize if I've jumped the gun on you.

The difference between simply deleting a file, and encrypting it is that the file becomes unusable after the fact, and a smart programmer would learn how to circumvent ways to recover those files by usual means, for instance, deleting every System Restore point.

Viruses typically embed themselves within a computer's startup files through the registry, and a standard way of getting around that is to hit F8 upon the computer being started up, so you could go into safe mode. Now, since everything's been encrypted, that's out of the question because the machine becomes virtually unusable, even if the Ransomware doesn't start up with the computer under those circumstances.

It's a smarter version of those old "Rogue Antivirus" programs, which were popular in the Windows XP era of computers.

Was your RAT a direct-connection rat, to where you must connect to the user's computer by typing in his LAN address (assuming you're testing using VMs) like old trojan horses in the 90s (Netbus, Sub7, etc) or was it a reverse connection rat, like the ones that have become conventional today to where your computer acts as the server, and each victim's computer becomes a client connecting to a DNS that you set up? Or as you said, something with no malicious intent like a Teamviewer clone?

ShadowTheRaven wrote:

What Antiviruses look for is a program that can take advantage of your computer's inner workings. Trojan Horses for example, like njRAT work by connecting your computer to a static DNS controlled by the hacker through a simple client/server setup.

Is it also worth mentioning that njRAT was coded in Visual Basic .NET?

https://www.youtube.com/watch?v=mZBeLFKvUis

Here's a Trojan Horse in action, from the hacker's side for instance.

What you're forgetting is that files can always be recovered. In fact, all Windows PCs with the Windows 2000 operating system and newer have this feature. Really the only way they couldn't be recovered is if you were somehow dumb enough to infect yourself with WannaCry.

ShadowTheRaven wrote:

Soaring Eagle 666 wrote:

My point is just that an online antivirus scan is only meaningful when it finds a virus.

I understand that and I apologize if I've jumped the gun on you.

The difference between simply deleting a file, and encrypting it is that the file becomes unusable after the fact, and a smart programmer would learn how to circumvent ways to recover those files by usual means, for instance, deleting every System Restore point.

...

Was your RAT a direct-connection rat, to where you must connect to the user's computer by typing in his LAN address (assuming you're testing using VMs) like old trojan horses in the 90s (Netbus, Sub7, etc) or was it a reverse connection rat, like the ones that have become conventional today to where your computer acts as the server, and each victim's computer becomes a client connecting to a DNS that you set up? Or as you said, something with no malicious intent like a Teamviewer clone?

That's ok, and I also apologize if I've been overly critical of you. :)

I wasn't aware that System Restore includes documents. Isn't the purpose to restore the system to a functioning state if the registry or software gets messed up? As far as I know, it intentionally avoids the Documents folder. Out of the box, I don't think Windows keeps any kind of secure backups of personal files. (Possibly OneDrive, but I think that still requires setup.)

That's a neat video of njRAT in action! It looks remarkably similar to mine (which I wrote before I even knew what a RAT was). In my RAT, I hardcoded my computer's IPv6 address. When the program loads, it reports the destination IP address to me, which I keep in a list. It then maintains an idle HTTP connection, waiting for instructions. I wrote a master control program that lets me "open" any online computers. I can transfer files, use the clipboard, and remotely control the mouse and keyboard while viewing the screen. It's not meant for collaboration, but rather to provide centralized access. I have a bunch of computers around the house, so this is quite a time saver.

Soaring Eagle 666 wrote:

That's ok, and I also apologize if I've been overly critical of you. :)

I wasn't aware that System Restore includes documents. Isn't the purpose to restore the system to a functioning state if the registry or software gets messed up? As far as I know, it intentionally avoids the Documents folder. Out of the box, I don't think Windows keeps any kind of secure backups of personal files. (Possibly OneDrive, but I think that still requires setup.)

That's a neat video of njRAT in action! It looks remarkably similar to mine (which I wrote before I even knew what a RAT was). In my RAT, I hardcoded my computer's IPv6 address. When the program loads, it reports the destination IP address to me, which I keep in a list. It then maintains an idle HTTP connection, waiting for instructions. I wrote a master control program that lets me "open" any online computers. I can transfer files, use the clipboard, and remotely control the mouse and keyboard while viewing the screen. It's not meant for collaboration, but rather to provide centralized access. I have a bunch of computers around the house, so this is quite a time saver.

I've only used System Restore a handful of times, and it was at an age where I wasn't so proficient with computers. All I had was a computer me and my grandfather put together, and it had Windows 2000 installed on it. If I did a System Restore, it also restored files that were deleted before that day. I can't tell you for sure if that's true on the newer Windows Operating Systems, since we now have OneDrive as you mentioned but back in the day that was the case so it'd make sense to come to the same conclusion that it works the same way on Windows 10, 8, 7, Vista, XP, as it did for Windows 2000 wouldn't it?

Soaring Eagle 666 wrote:

...

Did you end up checking the source code? Is it safe?

Stormblood wrote:

Soaring Eagle 666 wrote:

...

Did you end up checking the source code? Is it safe?

Yes I did. The code appears to be safe. But I can't guarantee that the .exe is safe because I don't have that version of Visual Studio to try to duplicate the file. However, Visual Basic Express is free, so anyone can build the source for themselves. To be on the safe side, you can delete the "bin" and "obj" folders (the only places with compiled binaries) after unzipping it, and Visual Studio will regenerate them upon compilation.

Soaring Eagle 666 wrote:

Stormblood wrote:

Soaring Eagle 666 wrote:

...

Did you end up checking the source code? Is it safe?

Yes I did. The code appears to be safe. But I can't guarantee that the .exe is safe because I don't have that version of Visual Studio to try to duplicate the file. However, Visual Basic Express is free, so anyone can build the source for themselves. To be on the safe side, you can delete the "bin" and "obj" folders (the only places with compiled binaries) after unzipping it, and Visual Studio will regenerate them upon compilation.

Thanks for you reply. It appears both files he shared (the programme and the source code) are down now, though. So, we won't be using that software anytime soon.