Windows C++ / Geofencing
Author | Thomas Roccia (fr0gger) |
Platform | Windows |
Language | C++ |
Technique | Geofencing |
Description:
In this code, the IsLanguageInstalled
function is used to check if the specified language, indicated by its LCID (Language Code Identifier), is installed on the system. In this case, the malware could check the languages installed on a Windows machine and not run if Russian is present.
Code
#include <Windows.h>
#include <winreg.h>
#define LANG_KEY "SYSTEM\\CurrentControlSet\\Control\\Nls\\Language"
#define RUSSIAN_LCID 1049
// Check if the specified LCID is installed on the system
bool IsLanguageInstalled(LCID lcid)
{
HKEY hKey;
if (RegOpenKeyEx(HKEY_LOCAL_MACHINE, LANG_KEY, 0, KEY_READ, &hKey) == ERROR_SUCCESS)
{
DWORD dwIndex = 0;
WCHAR szValueName[32];
DWORD dwValueNameLen = sizeof(szValueName);
while (RegEnumValue(hKey, dwIndex++, szValueName, &dwValueNameLen, NULL, NULL, NULL, NULL) == ERROR_SUCCESS)
{
LCID lcidValue = _wtoi(szValueName);
if (lcidValue == lcid)
{
RegCloseKey(hKey);
return true;
}
}
RegCloseKey(hKey);
}
return false;
}
int main()
{
if (IsLanguageInstalled(RUSSIAN_LCID))
{
// Russian language is installed, do not run malware
return 0;
}
else
{
// Russian language is not installed, run malware
// ...
}
return 0;
}
Created
December 13, 2022
Last Revised
April 22, 2024