根据一个壳魔改的FastPayLoad+工具

0殺神在心0

VirusTotal - File - bc6c03426ccde7c8f1318cbdb0fd4c74a2a5b3000f2b5e452a35242ed73e3d63
免杀效果有点参差不齐
看原本文件效果吧
ClientXor.bin放在和PayLoad一个目录下面就行了
想要用别的Shellcode也行 异或密钥是0xAB
加载器很低级 应该都能动态杀吧
IP指向 127.0.0.1



https://wwm.lanzoub.com/b00l125uta
密码:fkly

t0kenzero

腾讯IOA



似乎每个都会标记上注入标签，很神奇

1. 2024-07-16 07:05:30.855        INFO        cache/filecopyassoc.go:56        FileCopyAssocCache query assocfile: c:\users\rhinelab\desktop\payload1(infected)\wdksetup.exe [] --> file: c:\users\rhinelab\desktop\fastpayload (infected)\fastpayload\wdksetup.exe
   
2. 2024-07-16 07:05:30.857        INFO        cache/getfileinfo.go:172        GetFileInfoCache file: c:\users\rhinelab\desktop\payload1(infected)\wdksetup.exe not exist
   
3. 2024-07-16 07:05:30.858        INFO        inf/tracelog.go:43        event_10203 File_FileWriteClose(ModeAsync) 标签策略 cost(3,1067) TagEngine queryTagRules rule: 新入文件标签 file: wdksetup.exe ctags: [{NewFile  72}]
   
4. 2024-07-16 07:05:30.858        INFO        inf/tracelog.go:43        event_10203 File_FileWriteClose(ModeAsync) 标签策略 cost(0,1067) TagEngine queryTagRules rule: 可疑新入标签 file: wdksetup.exe ctags: [{NewSuspicious  876000}]
   
5. 2024-07-16 07:05:30.859        INFO        inf/tracelog.go:43        event_10203 File_FileWriteClose(ModeAsync) 标签策略 cost(1,1068) TagEngine queryTagRules rule: 进程注入标签 file: wdksetup.exe ctags: [{InjectProc  72}]

复制代码

BitterLotus

DI全杀

biue

腾讯电脑管家 1X