This is the C version of the original Python project.
The project was made mostly for learning Windows API behavior, file locking, persistence techniques, and general malware triage/testing in lab environments.
The code scans common user directories, filters files by extension, and keeps file handles open to demonstrate lock behavior on Windows systems.
The persistence included in this version is intentionally simple and very easy to detect. It was left that way on purpose for testing and analysis.
Some of the persistence methods used:
- Run registry key
- Scheduled task creation
- Copying itself into common directories
This is not meant to bypass EDRs or antivirus software. Most modern security products will detect parts of it without much effort.
MinGW example:
gcc ghost_lock_triagetest.c -o smth.exe \
-ladvapi32 -lshell32 -lkernel32 -lole32