Collection of remote Shellcode Loaders using Asyncronous Procedure Calls. The code is pretty simple and uses high level libraries (easy to flag) and encrypted shellcode. This code is for educational purposes only, do not use it for any malicious or unauthorized activity.

💻 Code

This repo consists of 3 projects that have the same basic structure and share most of the code, they are: APC Process injection, DLL version (targeting its own process), and a DLL Injector (LoadLibrary using APC), the shellcode is for a windows msg box.

1) APC Process Injection

First the shellcode is decrypted, for a better view of the encryption mechanism check it out here, then the code

2) DLL Version

3) DLL Injection

🛡️ AV Detection

On the right are the virus total detections for the 3 samples and their obfuscated versions.

The first and last are easily blocked by bitdefender and sometimes windows defender. The DLL bypasses them both except for Bitdefender Advanced Threat Defense (which Is very difficult to bypass i've tried everything xd).