PE-Obfuscator
PE obfuscator with Evasion in mind , needs Admin Privilege in order to load RTCore64 driver.
Video:
PE-Obfuscator.mp4
The Obfuscator :
- Gets xored Fileless PE from a remote server
- Drop the Loader in the disk
- Add random section to that Loader
- Add the xored Fileless PE to the new created Loader section
The Loader :
- Unhook ntdll from knowndlls
- Drop RTCore64 to the disk
- Load/Install RTCore64
- Exploit RTCore64 to Remove Kernel Callbacks
- xor PE
- Map/Load PE from the added Section
- Stomped a big module that fit the PE.
Credits :
https://br-sn.github.io/Removing-Kernel-Callbacks-Using-Signed-Drivers/
https://github.com/br-sn/CheekyBlinder
https://github.com/lawiet47/STFUEDR
https://papers.vx-underground.org/papers/Windows/Infection/2015-03-06%20-%20PE%20Infection%20-%20Add%20a%20PE%20section%20-%20with%20code.txt