mirror of
https://codeberg.org/smukx/Rust-for-Malware-Development
synced 2026-06-06 20:22:59 +00:00
Whitecat18
28e7fac1d3
Rust-for-Malware-Development is an collection of proof of concepts with techniques and advanced evasion methods
Sleep Obfuscations
Welcome to the Sleep_Obfuscations directory of Rust-for-Malware-Development.
While an implant is asleep its decrypted code, strings, and heap structures sit exposed in memory — easy pickings for an EDR scan. Sleep-obfuscation closes that window: the implant re-encrypts itself before going dormant and only decrypts back when it has real work to do.
Sections & Links
- Ekko: Rust port of the well-known Ekko sleep-obfuscation routine. Uses queued timers and ROP-style callbacks to flip the implant's own pages between R/W (so it can encrypt them) and R/X (so it can execute again) without ever leaving an unencrypted RX region during the sleep.
How to Use
git clone https://github.com/Whitecat18/Rust-for-Malware-Development.git
cd Rust-for-Malware-Development/Sleep_Obfuscations
The sub-folder is a Cargo project. Build with cargo build --release.