Light

aaaddress1 / skrull Goto Github PK

Skrull is a malware DRM, that prevents Automatic Sample Submission by AV/EDR and Signature Scanning from Kernel. It generates launchers that can run malware on the victim using the Process Ghosting technique. Also, launchers are totally anti-copy and naturally broken when got submitted.

License: Apache License 2.0

C 92.85% C++ 7.15%

injection bypass-antivirus

skrull's Introduction

Skrull

It's a proof-of-concept of the talk of ROOTCON & HITCON 2021, check out Skrull Like A King: From File Unlink to Persistence and Skrull Like A King：從重兵看守的天眼防線殺出重圍 :)

note that currently support only x64 PE now, due to the ghosting technique.

Video Demo

skrull's People

Contributors

Stargazers

Watchers

Forkers

808mak1r fzkiritsugu askyeye chann-tx savsanta superuser5 run0nceex sulaimanzai hotelzululima bravery9 sinw0lf dr-r00t3r cybersecops leftp scriptidiot valerian7 gavz gitlabgit123 codyjohnston globalsecureacademy credteam green-parrot-sec traxsw pr0tean redwifiteam spamv techthupport ognz minkione alinasec invokethreatguy killvxk phuong39 freeide an4kein fuckup1337 topotam fcccode t43wiu6 5l1v3r1 newmoneybigbucks manantsoar kagura-maru jermainlaforce kaganisildak e4rl bruto001 chomikmarkus jack51706 pitbullcan marciopocebon pwntheworld t3hpaul sts0mrg0 levisre usama7628674 lenz913 msf-ntdll n00xt budi-khoirudin j5s r1card0-tutu 4n6strider korallin shantanu561993 yeah9782 elsisoft re-expoc v4nyl come2darkside kddco gmh5225 ellen2015 gl4ssesbo1 1rm a7t0fwa7 fengjixuchui root13920 bhargavratnareddy cvlabsio webstorage119 xkroot brugarolas

skrull's Issues

options

Hey! When i tried to '--build' like in ur video i have nothing. Only -a write 'anti-copy armer enable' others write nothing

Errors when compiling in Visual Studio

Hi, I'm compiling the source code in Visual Studio Community 2019 but am getting the following errors:

What I'm doing is launch Visual Studio 2019 > Open a project or solution > Skrull.vcxproj.

Please let me know if there is a way to resolve this or an alternative way of compiling. Thank you.

Anti-Copy Bypass

Hey!
Could you confirm if the anti-copy feature relies on the second system having a different version of the targeted DLLs?

I just tested on 2 systems with the same Windows version and the anti-copy seems bypassed.
Thanks!

Recommend Projects

React

A declarative, efficient, and flexible JavaScript library for building user interfaces.
Vue.js

🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
Typescript

TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
TensorFlow

An Open Source Machine Learning Framework for Everyone
Django

The Web framework for perfectionists with deadlines.
Laravel

A PHP framework for web artisans
D3

Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

javascript

JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
web

Some thing interesting about web. New door for the world.
server

A server is a program made to process requests and deliver data to clients.
Machine learning

Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Visualization

Some thing interesting about visualization, use data art
Game

Some thing interesting about game, make everyone happy.

Recommend Org

Facebook

We are working to build community through open source technology. NB: members must have two-factor auth.
Microsoft

Open source projects and samples from Microsoft.
Google

Google ❤️ Open Source for everyone.
Alibaba

Alibaba Open Source for everyone
D3

Data-Driven Documents codes.
Tencent

China tencent open source team.