Kurosh Dabbagh Escalante e238146cf7 Version 2.0.0 (#6) ...

* Setup script and other small changes

* Changes to make the setup.ps1 script work properly

* Update README.md

* Update README.md

* Update README.md

* Some code improvements

* Update README.md

* C&C features removed; ETW patch and DInvoke added.

In the C&C Python console the options execute, downexec and copy have been removed.
In the C# agent, ETW is now patched before setting up the reverse connection and the DInvoke technique (check out SharpSploit!) is being used to replace some PInvoke calls.
DInvoke removes IAT Win32 API entries and also avoids EDR API hooking by  manually loading and mapping the required modules.

* Some minor changes

* PInvoke removed.

* DInvoke implemented and some other minor changes

* Processess listing improved

* Strings encoded using base64

* AMSI patching added.

* LdrLoadDll hooking added to deny undesired DLLs (like EDR's) in our process.

This will protect our malware from some EDR dll injections. Since the hooking is using DInvoke and manual module mapping its a bit slow, which may give enough time to the EDRs to load their Dlls in our process in some cases.

* Update Controller.cs

* LdrLoadDll hooking removed temporally. Great fixes on GetSystem and EnablePrivileges.

* Basic sandbox detection added.

* RWX memory protection removed from direct syscalls shellcode allocating. and others

* Update README.md

* Update README.md

* update images

* Update README.md

2020-08-25 18:09:50 +02:00

110 KiB

909x685px

Raw History