• no crt functions imported
  
• syscall unhooking usingKnownDllUnhook
  
• api hashing using Rotr32 hashing algo
  
• payload encryption using rc4 - payload is saved in .rsrc
  
• process injection - targetting 'SettingSyncHost.exe'
  
• ppid spoofing & blockdlls policy using NtCreateUserProcess
  
• stealthy remote process injection - chunking
  
• using debugging & NtQueueApcThread for payload execution

• useGenzeloteRsrcto updateDataFile.terrathat'll be the payload saved in the .rsrc section of the loader

• https://offensivedefence.co.uk/posts/ntc...erprocess/
  
• https://github.com/vxunderground/VX-API

(31 October, 2022 - 11:00 PM)fightsdntmatter Wrote: Show More
TerraLdr - A Payload Loader Designed With Advanced
Evasion Features

like, comment, stick afinger in ur butt, etc..;

TerraLdr: A Payload Loader Designed With Advanced Evasion FeaturesDetails:

• no crt functions imported
  
• syscall unhooking usingKnownDllUnhook
  
• api hashing using Rotr32 hashing algo
  
• payload encryption using rc4 - payload is saved in .rsrc
  
• process injection - targetting 'SettingSyncHost.exe'
  
• ppid spoofing & blockdlls policy using NtCreateUserProcess
  
• stealthy remote process injection - chunking
  
• using debugging & NtQueueApcThread for payload execution

Usage:

• useGenzeloteRsrcto updateDataFile.terrathat'll be the payload saved in the .rsrc section of the loader

Thanks For:

• https://offensivedefence.co.uk/posts/ntc...erprocess/
  
• https://github.com/vxunderground/VX-API

Profit:

Click to expand...