{"id":28274,"date":"2023-02-10T12:43:02","date_gmt":"2023-02-10T12:43:02","guid":{"rendered":"https:\/\/kalilinuxtutorials.com\/?p=28274"},"modified":"2023-02-11T16:47:57","modified_gmt":"2023-02-11T16:47:57","slug":"aceldr","status":"publish","type":"post","link":"https:\/\/kalilinuxtutorials.com\/aceldr\/","title":{"rendered":"AceLdr : Cobalt Strike UDRL For Memory Scanner Evasion"},"content":{"rendered":"\n

AceLdr <\/strong>is a position-independent reflective loader for Cobalt Strike. Zero results from Hunt-Sleeping-Beacons<\/a>, BeaconHunter<\/a>, BeaconEye<\/a>, Patriot<\/a>, Moneta<\/a>, PE-sieve<\/a>, or MalMemDetect<\/a>.<\/p>\n\n\n\n

Features<\/h2>\n\n\n\n

<\/a>Easy to Use<\/h4>\n\n\n\n

Import a single CNA script before generating shellcode.<\/p>\n\n\n\n

<\/a>Dynamic Memory Encryption<\/h4>\n\n\n\n

Creates a new heap for any allocations from Beacon and encrypts entries before sleep.<\/p>\n\n\n\n

<\/a>Code Obfuscation and Encryption<\/h4>\n\n\n\n

Changes the memory containing CS executable code to non-executable and encrypts it (FOLIAGE).<\/p>\n\n\n\n

<\/a>Return Address Spoofing at Execution<\/h4>\n\n\n\n

Certain WinAPI calls are executed with a spoofed return address (InternetConnectA, NtWaitForSingleObject, RtlAllocateHeap).<\/p>\n\n\n\n

<\/a>Sleep Without Sleep<\/h4>\n\n\n\n

Delayed execution using WaitForSingleObjectEx.<\/p>\n\n\n\n

<\/a>RC4 Encryption<\/h4>\n\n\n\n

All encryption performed with SystemFunction032.<\/p>\n\n\n\n

<\/a>Known Issues<\/h2>\n\n\n\n