<commit_before>[NullArray Fork/Commit Note]
 
 First off the credit for the backdoor and controller go to byt3bl33d3r. Thanks for this sweet tool.
 
That being said the original did not offer anything by way of persistence so this is my attempt to remedy that. 
The general idea is that the compiled implant would be uploaded to a remote host and the downloader bound to an innocent binary
for deployment.

Once executed the downloader will run shellcode generated in example by the metasploit framework's msfvenom, 
to download the implant to a predefined directory, the path for which will be specified within the shellcode and the downloader
before compiling. The shellcode will then execute the implant.

Finally i've added some logic to have the downloader add a registry entry to point to the path of the implant
to have it run at boot. Please note that this is a work in progress and that some improvement may be desirable.

On how to operate the rest of the tool please see the original readme below.
 
 



Gcat
====
A stealthy Python based backdoor that uses Gmail as a command and control server

Setup 
=====
For this to work you need:
- A Gmail account (**Use a dedicated account! Do not use your personal one!**)
- Turn on "Allow less secure apps" under the security settings of the account<commit_msg>Update: Downloader now disables task manager.<commit_after>[NullArray Fork/Commit Note]
 
 First off the credit for the backdoor and controller go to byt3bl33d3r. Thanks for this sweet tool.
 
That being said the original did not offer anything by way of persistence so this is my attempt to remedy that. 
The general idea is that the compiled implant would be uploaded to a remote host and the downloader bound to an innocent binary
for deployment.

Once executed the downloader will run shellcode generated in example by the metasploit framework's msfvenom, 
to download the implant to a predefined directory, the path for which will be specified within the shellcode and the downloader
before compiling. The shellcode will then execute the implant.

Finally i've added some logic to have the downloader add a registry entry to point to the path of the implant
to have it run at boot.

The downloader now also disables the task manager to somewhat protect the implant.exe process from being terminated. 

Please note that this is a work in progress and that some improvement may be desirable.

On how to operate the rest of the tool please see the original readme below.
 
 



Gcat
====
A stealthy Python based backdoor that uses Gmail as a command and control server

Setup 
=====
For this to work you need:
- A Gmail account (**Use a dedicated account! Do not use your personal one!**)
- Turn on "Allow less secure apps" under the security settings of the account
{'fraction_non_alphanumeric': 0.03089080459770115, 'fraction_numerical': 0.0028735632183908046, 'mean_word_length': 4.24482109227872, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 12, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6998187', 'n_tokens_mistral': 707, 'n_tokens_neox': 654, 'n_words': 455}