This is a PoC of encrypting the stack prior to custom sleeping by leveraging CPU cycles. This is the code of the relevant blog post: Masking the Implant with Stack Encryption
Retrieve the RSP address to identify where the stack begins. Then use VirtualQuery to retrieve the range of the page of the virtual address space of the calling process, in order to calculate the end of the stack. Before encrypting, suspend the thread to avoid any abnormal behavior.
The sleep mechanizm is taken from: https://shubakki.github.io/posts/2022/12/detecting-and-evading-sandboxing-through-time-based-evasion/
Kleiton Kurti (@kleiton0x00)