How to bypass Windows Defender - with .DLL FilelessPELoader (Meterpreter Reverse Shell)

[@tlykuyiyhaa8382]

Thanks man, i am Happy now because u are back

[@TechFutureFocus]

Thanks you so much , we need more lessons about encryptions and bypass security , and how we bind payload with other files , plus if we can change the extension too

[@tushar6767]

Thank you so much for adding cutshots it will help me out with my thinking how to edit code as well if it got detected 😄

[@hssllzzzZz]

have you tried using "threatcheck" and "ghidra" to spot the signatures in a more convinient way and less try and error?

[@sscoconut1265]

threatcheck.exe said it was clear but whenever I remove the exclusion folder of the FilelessPELoader build, it gets detected by defender

[@batukacovski]

What courses would you recommend to write our own viruses with c++ or python, how did you become a professional like this, what are your suggestions?

[@essabreahmed1391]

think you

[@revenant9171]

awesome! it worked for me. How come you have to make it a dll to run metereter shells vs .exe? for winpeas.exe, should we use a.dll or filelesspeloader.exe?

[@gemini_security]

Hello,
Detections from security solution vendors such as Microsoft Windows Defender are generally better at detecting .EXE file types as compared to .DLLs.
In this case it is especially true since the FilelessPELoader file by defaults compiles to .EXE. If we were to change it a little, such as the output type to .DLL instead, chances are it will bypass the detection.
Ultimately it is up to you to experiment what works best in your situation.
Cheers!

[@hiddengo3232]

How to abuse living of the land drivers?

[@giomke]

Are you sure that variable renaming changes anything in detection?
It is C/C++ and compiled directly in machine language. It is not java/C# to have intermediate language and needed to change variables to avoid detections

[@hihihihi3806]

Changing variable names does nothing, as it all gets stripped when compiled.

[@amirakmel123]

​@@hihihihi3806 so what makes the payload to be undetected???

[@hihihihi3806]

@@amirakmel123 You can encrypt the strings at compile time using something like skCrypt. You can also create your own packer

[@amirakmel123]

@@hihihihi3806 I'll try it tnx😇

[@sscoconut1265]

changing the variables does not work anymore

[@gemini_security]

Yep totally expected that to happen sooner or later from Windows Defender.
You can probably get away with more changes, like adding additional code into the function, changing the number of arguments the function takes, etc.

[@sscoconut1265]

@@gemini_security thanks for the tips man..do you have a video on how to obfuscate or encrypt code? I'm new to this av bypass part of cybersecurity..thanks again

[@ninialovedog]

This is now deleted by the Windows Defender

[@gemini_security]

The cat and mouse game continues!

[@hihihihi3806]

Obfuscate the strings! It will bypass defender very well

[@jz3376]

Is it possible to load mimikatz after obfuscating the source code and build it?

[@hihihihi3806]

@@jz3376 Create your own loader (using FilelessPELoader) and change some stuff around like obfuscating strings, packing it, etc. Next, add a custom sleep function that spams random noise (such as printing random hashes) then executing the program. It will bypass 90% of AVs

[@romanxyz7248]

@@hihihihi3806 Can you recommend me a few resources on how to dive deep into custom malware development? Also, what programming language do you use for creating all this stuff (PE loader, Custom Shellcode injecter, etc) I have experience creating simple exploits in Python. If you have discord, then please give me so we can talk more about it there.

[@hihihihi3806]

@@romanxyz7248 elreygato

[@firos5381]

life sucks now cause my gf left me

[@diaverso5794]

I have this error, in case someone can help me
/usr/bin/x86_64-w64-mingw32-ld: /tmp/cchxz1cB.o:fl.cpp:(.text+0x1342): undefined reference to `GetModuleInformation'
collect2: error: ld returned 1 exit status