mirror of
https://github.com/Astharot15/COMLoaderAstharot/
synced 2026-07-13 20:52:26 +00:00
Astharot15
1dacf94474
Added details about hijack targets, callback, download function, payload synchronization, and COM object reliability.
14 lines
572 B
Markdown
14 lines
572 B
Markdown
## COM Hijack for CLSID {9FC8E510-A27C-4B3B-B9A3-BF65F00256A8}
|
|
|
|
### Interesting details
|
|
|
|
The hijack targets chrome and msedge; it also works in explorer, but it is likely to crash.
|
|
|
|
The callback used is **LdrCallEnclave**.
|
|
|
|
A Download function is commented out. It worked in the .exe compilation, but when compiled as a dll, it gets caught by AVs; so instead of using wininet, winhttp was used.
|
|
|
|
The payload uses event objects for process synchronization rather than a traditional mutex.
|
|
|
|
The COM object is very reliable; it has been working for 6 months without crashes.
|