🔥 Introducing RustPack 🔥 . RustPack is an evasive Packer/Loader, that is capable of bypassing common AV/EDR vendors. It accepts user-provided known malicious input payloads, such as shellcode, C# assemblies or portable executables (PE). Those inputs are encrypted, and decrypted on runtime by a newly generated non non-malicious payload. This process is known to be called packing or crypting. Some Features: - Each payload looks different, making signature creation more difficult. - Userland hooks are bypassed by default for each generated payload. - The encryption key is never fully embedded in the final payload but always retrieved on runtime. This is good for bypassing emulators or automatic unpacking engines. - Encrypted payloads can also be decoupled from the new binary to load them from a remote location on runtime - Multiple Anti-Debug techniques are applied to each payload by default. - Environmental Keying and Anti-Sandbox options included. - No cloud service. The software is delivered to the customer as a closed source solution Evasion options: - Several AMSI bypass techniques ranging from Patching to using Hardware Breakpoints - Multiple optional ETW bypasses - Support for Module stomping - OPSec safe remote injection techniques such as ThreadlessInject or a customised Caro-Kann technique The tool is still under active development and lot's of features/demos/etc. will follow. Some more information can be found here: msecops.de/products #redteam #pentesting #pentest #OST

Mythos is amazing.

As promised Rustypacker has released today. A native Rust shellcode packer with a GUI Repo:- github.com/Whitecat18/RustyP… What did I bring to the table :- - Indirect syscalls for memory allocation and protection by default. - AES-256-CBC, XOR, UUID-encoded shellcode encryption. - Six self-injection paths through callback APIs. - Fiber switch self injection. - Three remote-process injection. - Anti-debuging Techniques. - NtDelayExecution sleep evasion with placement control. - Domain pinning evasion. - Output formats: EXE, DLL, DLL Sideload (Sideload or Proxy with auto-generated .def for unhandled exports). - Builds for x86_64-pc-windows-msvc and x86_64-pc-windows-gnu. - DllMain stays a NO-OP. Payload rides four COM-friendly exports: Run, DllRegisterServer, DllGetClassObject, DllUnregisterServer. - crt-static link. No runtime DLL footprint. - XOR-obfuscated NT API names embedded in the binary. - Generated target/ auto-cleaned after each successful build. #redteam #malwaredev #rust #offsec #infosec #windbg

🙃