000o0 / PowerLoaderEx

PowerLoaderEx - Advanced Code Injection Technique for x32 / x64

PowerLoaderEx

• Advanced Code Injection Technique for x32 / x64
• More Info: http://goo.gl/3CdZHw

Original PowerLoader

• Known since ~2013
• Loader used in many different dropper families (Gapz / Redyms / Carberp / Vabushky ...)
• First injection technique via Return Oriented Programming technique (ROP).
• “explorer.exe” is injected using Shell_TrayWnd / NtQueueApcThread (32bit / 64bit)

PowerLoaderEx

• Injection via shared desktop heap
• Remove dependency in Explorer.exe shared sections (more generic)
• Injection without reading memory from the target process
• 32 and 64-bit versions (same technique)

#Tested Environments

• Windows 7 32 and 64 bit.

Authors

• BreakingMalware.com