Simone Licitra 74b0d2ed1b feat: two-file stager with AES-256-CBC evasion (bypasses Wacatac.B!ml + ZomBytes.B) ...

- Redesign stager as two-file delivery: csvchelper.exe (~17 KB) + payload.dat
  (AES-256-CBC encrypted PICO). Removes the 36 MB high-entropy .data blob that
  triggered VirTool:Win64/ZomBytes.B static detection.
- Replace XOR+NtCreateSection approach with BCryptDecrypt (AES-256-CBC) +
  VirtualAlloc(RW)/VirtualProtect(RX). No Nt* strings in .rdata, no
  PAGE_EXECUTE_READWRITE mapping, no GetProcAddress/ntdll pattern.
- Add manifest.xml (asInvoker, RT_MANIFEST resource ID 1) to suppress UAC
  auto-elevation triggered by "Update"/"Service" keywords in FileDescription.
- Update FileDescription in resource.rc to avoid UAC heuristic trigger words.
- gen_payload.py now calls openssl for AES encryption; produces payload.dat +
  payload_key.h (key+IV, compiled in, never committed via .gitignore).
- Makefile: add -s (strip symbols), -ffunction-sections/-fdata-sections,
  --gc-sections to keep binary clean and small.
- Update all docs (RUNBOOK, TOOLCHAIN, README, crystal-kit-sliver/README)
  to reflect two-file delivery, new evasion profile, and UAC fix.

2026-06-11 16:46:46 -04:00

..

PORTING_MAP.md

feat: rystal Palace evasion kit ported to Sliver C2

2026-05-14 08:50:51 +02:00

RUNBOOK.md

feat: two-file stager with AES-256-CBC evasion (bypasses Wacatac.B!ml + ZomBytes.B)

2026-06-11 16:46:46 -04:00

TOOLCHAIN.md

feat: two-file stager with AES-256-CBC evasion (bypasses Wacatac.B!ml + ZomBytes.B)

2026-06-11 16:46:46 -04:00