TerraLdr - A Payload Loader Designed With Advanced Evasion Features

TerraLdr: A Payload Loader Designed With Advanced Evasion Features

Details:

• no crt functions imported
• syscall unhooking using KnownDllUnhook
• api hashing using Rotr32 hashing algo
• payload encryption using rc4 - payload is saved in .rsrc
• process injection - targetting 'SettingSyncHost.exe'
• ppid spoofing & blockdlls policy using NtCreateUserProcess
• stealthy remote process injection - chunking
• using debugging & NtQueueApcThread for payload execution

Usage:

• use GenerateRsrc to update DataFile.terra that'll be the payload saved in the .rsrc section of the loader

Thanks For:

• https://offensivedefence.co.uk/posts/ntcreateuserprocess/ …

advanced edrs evasion features loader payload spoofing windows