This is a daemon process which make a program runing all time.

3vilGu4rd is a persistent maintenance tool. It is written in VBS and packaged into a binary file with a VBE suffix. In theory, all systems after xp can run. After testing, the persistent can be maintained normally in win7, win server 2008, win2019, win10 and win11.

You can upload it to the victim's host when you get the host persistent, run the program, and specify the backdoor Trojan or other commands to maintain the persistent. The operation method is as follows:

1. Upload the daemon 3vilGu4rd.vbe to the target host, and then upload the Trojan to the victim host (remote.exe, custom path)

2. Use CS shell to remotely call 3vilGu4rd.vbe to guard our Trojan program.

   3vilGu4rd.vbe (absolute path / Relative path of Trojan) [process name]

3. Double-click to run the program or use the shell to directly call the program, and the usage and precautions of the program will pop up. Do not execute directly in actual combat

1. "Mother-child" type daemon process, the mother program has no shellcode or malicious code, reducing the risk of the mother program being discovered
2. The subroutine has a single function, reducing the detection of malicious programs caused by heuristic detection
3. Dynamic generation, using the "avalanche effect", the Hash value of each generated file is different
4. The program self-destructs, the program will self-destruct after executing the function, leaving no trace
5. The Trojan will restart when the user log out or restart the machine
6. VBE format, good versatility, in theory, the system after XP can be used. VBE format is the encrypted version of VBS, the program code and encryption are relatively difficult to crack
7. At present, it can bypass the detection of domestic anti-software (non-Trojan programs)