# Independent Malware

The general process injection malware that we had written earlier won’t even actually work on other machines, and that is because it requires some DLLs provided by Visual Studio in order to run the program. There’s no use of developing something you can’t run on another machine. A DLL stands for Dynamic Link Library and it generally contains some code which can be utilized by other programs. There are a lot of advantages of doing so which can be read on the [Microsoft’s official documentation](https://learn.microsoft.com/en-us/troubleshoot/windows-client/setup-upgrade-and-drivers/dynamic-link-library).

[Capt. Meelo](https://twitter.com/CaptMeelo) has done a great job of explaining how we can achieve that on his [blog post](https://captmeelo.com/redteam/maldev/2022/10/17/independent-malware.html), so I will just highlight the things he mentioned + a few things that seemed interesting to me.

1. **Getting Rid of CRT (C Runtime Library)** - Project → Properties → C/C++ → Code Generation → Runtime Library → Multi threaded

<figure><img src="https://2432292127-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSCcfOQOO1zEN9SINI2QU%2Fuploads%2FLgGOZ2jQwg0Dy6IwoHpB%2Fimage.png?alt=media&#x26;token=44530671-99f9-40e6-8a84-819ed2e95b89" alt=""><figcaption></figcaption></figure>

2. **Ignore Default Libraries** - Project → Properties → Linker → Input → Ignore all default libraries → Yes

<figure><img src="https://2432292127-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSCcfOQOO1zEN9SINI2QU%2Fuploads%2FFOHZ6oTqAAABCouB5iaM%2Fimage.png?alt=media&#x26;token=5a55c4e6-f69b-4634-a192-28b804177a90" alt=""><figcaption></figcaption></figure>

3. Set Entry Point to main

<figure><img src="https://2432292127-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSCcfOQOO1zEN9SINI2QU%2Fuploads%2FNGHfTGCSfLs1WGn2LY8C%2Fimage.png?alt=media&#x26;token=1ef751d1-3f87-4938-a653-30d3e7a31cf4" alt=""><figcaption></figcaption></figure>

note that this can also be any other function as well

4. **Disabling Security Check**

<figure><img src="https://2432292127-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSCcfOQOO1zEN9SINI2QU%2Fuploads%2FzSdnean0KPZwziyFiXfK%2Fimage.png?alt=media&#x26;token=d6475f1c-49a4-4ab7-a717-0db2c2ad70e1" alt=""><figcaption></figcaption></figure>

These are the ones mentioned on the blog post, apart from these, I also faced a different error about `_RTC_InitBase` and 2 others like that, after poking around, I fixed it by changing the value of `Basic Runtime Checks` to Default

<figure><img src="https://2432292127-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSCcfOQOO1zEN9SINI2QU%2Fuploads%2FwPc8GpyAoMWQCi9yg6dW%2Fimage.png?alt=media&#x26;token=22119540-b3ba-41bf-ab65-76c17ec43979" alt=""><figcaption></figcaption></figure>

Now after checking the other settings as well, here are a few things that I found would be better to change.&#x20;

Switch to “Release” mode, this is always  preferable when malware has been developed or in its final stage.

<figure><img src="https://2432292127-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSCcfOQOO1zEN9SINI2QU%2Fuploads%2FXVXm1TTj3Gyk6kZ986Gw%2Fimage.png?alt=media&#x26;token=b2ee5a98-abc8-4823-bf4b-07c6dd7bbe0c" alt=""><figcaption></figcaption></figure>

No need to use Debug libraries

<figure><img src="https://2432292127-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSCcfOQOO1zEN9SINI2QU%2Fuploads%2F6IpDROHJRyRH0DCON67p%2Fimage.png?alt=media&#x26;token=751a6187-7f85-4809-a785-003297ba001b" alt=""><figcaption></figcaption></figure>

No need to generate debug info

<figure><img src="https://2432292127-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSCcfOQOO1zEN9SINI2QU%2Fuploads%2FUoKorjfOUs7WEz643XMh%2Fimage.png?alt=media&#x26;token=cba4ead8-73af-41ab-9653-3b5059d13089" alt="Project Properties -> linker -> generate debug info -> switch to No"><figcaption></figcaption></figure>

This should be it, if you have followed till here, thanks :). If you feel like I have missed something or made a mistake, feel free to reach me out on [twitter](https://twitter.com/ZzN1NJ4).
