Brief translation for some files located in project Pegasus source code leak...
Project Pegasus - Content brief description
Pegasus - complex structured project for x32 and x64 platforms.
Installer injects system kernel into svchost process memory and deletes the source file.
The initial installer passes the execution controls in the following way:
Shellcode -> InstallDispatcherDll
New process passes the execution controls in the following way:
Shellcode -> WorkDispatcherDll -> all other modules
If installing over existing deployment, the build ID check is performed and if found below or equal the current version the installation is canceled.
Modules functionality will take a while to explain and describe in here. If absolutely necessary look at the corresponding source code - the description there is well structured and documented.
Microsoft Visual Studio 2013+ and PHP Tools for Visual Studio from Devsense are required to build the project.
Compiled modules and other code for x32 and x64 platforms
Final installers for both platforms, debug and release version depending on the sub folder it's stored in.
Program libraries used by different sub-projects.
Installer module, performs injects into a new process
Initial installer project
Files necessary for compiling the project without MSVCRT
Resource packing utility
Command execution module using the panel(new process, console command, etc)
Domain propagation module
KBR payment swapping module
Injector module that intercepts KBR data exchange process and receives swapped data from mod_KBRI
Password extraction module, re-written and patched mimikatz code
Communication module, including using pipes for machines with restricted network access
Special Executable file that is uploaded to a remote system in case of domain propagation scenario.
Common header and configuration files
Attached libraries load and execution shellcode
Project assembly scripts and utilities
Client part of the admin panel, integrated into Studio project
Admin panel, copy from the development server
In general case,
\shared\config.h is configured first
\tools\MAKE_INSTALLERS.BAT with Release or Debug parameter assembles the rest
\BUILDS\ folder will contain the final build