[Ananke_Sec0]

Introducing Abismo Malware (Windows) — a complete malware suite that only brings benefits and requires very few resources to run.

Abismo is a sophisticated piece of malware capable of controlling thousands of machines from a single Telegram chatbot. The logic is simple: infected, ran, accessed — no red tape, no C2 servers to configure, no direct malware setup.

What makes Abismo a complete suite:

◬ ESPIONAGE

Keylogger with word-formation analysis, corrections, special-key detection, and automatic log delivery

Webcam capture with multi-camera detection and adaptive compression

Real-time clipboard monitoring

Live capture of real system notifications

Open port monitoring with associated process

Open window monitoring

Microphone recording with device selection and listing of connected microphones

Screen recording with video rendering and automatic splitting into parts

Targeted window monitoring by title, with continuous capture

Sensitive file extraction

Full directory download with compression and automatic splitting

Complete geolocation: city, region, country, coordinates, timezone, ISP, organization, and ASN

Reverse tunnel for exposing a local web server with a custom-themed interface

◬ BROWSERS

Extraction of decrypted passwords, session cookies, history, bookmarks, form data, and extensions from multiple browsers

Full data extraction from alternative browsers

Telegram Desktop session extraction with key decryption and multi-session compression

◬ COMMUNICATION

Live chat with the victim in a dedicated window, with key blocking and a two-way channel

Message delivery to the victim's chat

Remote chat termination

◬ WORM / SELF-REPLICATION

Simple worm mode

Advanced worm with full drive scanning, system folder exclusion, and polymorphism using multiple mutation techniques

Network replication with credential brute-forcing, detection of known vulnerabilities, and remote execution

Central monitor that reactivates the worm if the main process is terminated

Distribution report by drive, infected folders, and active copies

◬ PERSISTENCE & EVASION

Persistence through multiple mechanisms, including automatic startup, hidden shortcuts, and scheduled tasks running as SYSTEM

Full Windows Defender shutdown, including real-time protection, services, folders, and path exclusions

Operational rootkit: boot persistence, process/file/registry hiding, MBR infection, antivirus bypass, and system hooks

Ghost mode: console hiding, injection into legitimate processes, and masquerading under system process names

Privilege escalation: even when executed by a standard user, the malware can elevate to administrator/SYSTEM through multiple UAC bypasses — no password or user consent required

Antivirus detection: over 40 brands identified

Third-party antivirus removal via silent uninstaller, forced termination, and folder deletion

◬ SYSTEM INFORMATION

Windows credentials: saved credentials, Wi-Fi passwords, system vault, network connections, and saved RDP servers

System information: hostname, user, operating system, processor, architecture, memory, disk, network interfaces, and active connections

Running processes

Installed applications

Wi-Fi networks and passwords

Connected USB devices with categorization (hubs, storage, keyboards, mice, cameras, audio, Bluetooth, network)

Network scan with device detection, hostnames, and operating system identification

◬ RANSOMWARE

File encryption by path or full-system encryption with a derived key and custom extension

Ransom note and multiple copies across user folders

Decryption with provided key

Desktop cleanup

Fullscreen ransomware screen with visual symbol, 24-hour countdown, key blocking, input blocking, and system destruction when the timer ends

◬ ADWARE

Fullscreen browser ad window

Escape key blocking

Configurable URL, interval, duration, and mode (once/repeat)

Persistent configuration

◬ BOTNET (DDoS)

Multiple attack vectors

Per-attack ID control: start, stop, pause, resume, stop all, status

Periodic reports with packets sent, packets per second, data sent, speed, and active threads

Configurable bandwidth limit

◬ CONTROL
Dedicated control mode that acts as a selector, allowing direct commands that run on all machines or targeted redirection to specific machines via id=.

◬ LOCKDOWN (Admin Required)

Full or selective blocking of terminal, task manager, browsers, firewall, keyboard and mouse, drives, and USB

Blocking through multiple mechanisms, including registry, file attributes, and access permissions

Permanent lockdown with automatic rule reapplication

Reversible unlock for all categories

◬ ANTI-ANALYSIS

Virtual environment and sandbox detection through multiple indicators

Debugger and analysis tool detection

Anti-dump and anti-attach protections

Process masquerading under legitimate system names

String obfuscation and code mutation

◬ SINGLE-INSTANCE CHECK

Prevention of multiple instances

Takeover system: if the main process is terminated, a new instance takes over and notifies

◬ HEALTH & DIAGNOSTICS

Health tracker with intelligent heartbeat, uptime statistics, average latency, and status

Self-diagnostics with alerts for no internet or unstable connection

Automatic reconnection

◬ BONUS — POWERFUL INJECTOR

Abismo also ships with a powerful standalone injector — a builder that binds the malware into any legitimate executable, turning it into a fully weaponized file without breaking the host's behavior.

Universal EXE infection — injects the payload into virtually any .exe file, preserving the original application so it still runs normally for the victim

Mass folder infection — a dedicated mode that scans an entire directory recursively and infects every executable found inside it in a single pass

Dual-layer encryption — both the host executable and the payload are individually encrypted with strong symmetric encryption, then compressed at maximum level before being embedded

Key derivation hardening — encryption keys are derived with a heavy, salted, high-iteration key derivation function, making static analysis and signature extraction significantly harder

Fully obfuscated payload — all embedded data is stored as encrypted, encoded blobs inside the launcher, so the final binary reveals nothing on plain inspection

Silent staged execution — on launch, the injector decrypts both files into the system temp directory, runs the payload silently in the background, then runs the original host application so the victim notices nothing unusual

Automatic cleanup — after execution, all dropped files are removed from the temp directory, leaving no obvious trace behind

Icon preservation — extracts and reuses the original executable's icon so the infected file looks identical to the legitimate one

UAC-aware — automatically detects whether the original host requires administrator privileges and mirrors that behavior in the final build, so the infected file blends in naturally

Silent, windowless build — the final executable is compiled as a single-file, no-console binary, running entirely in the background without any visible window

DLL support — any DLLs sitting next to the host executable are also encrypted and embedded, ensuring the original application still works correctly when run from the temp directory

Metadata preservation — the original file's modification timestamp is restored after infection, so the file's date looks untouched

Clean final output — the injector produces a single, ready-to-deploy executable that carries the full Abismo payload inside a legitimate-looking host, ready to spread

This turns Abismo from a standalone threat into a self-spreading weapon: any infected executable becomes a new delivery vector.



If you're interested in this weapon, reach out!