Skip to content

Latest commit

 

History

History
25 lines (21 loc) · 1000 Bytes

README.md

File metadata and controls

25 lines (21 loc) · 1000 Bytes

Undergrowth - Under active development

picture alt

Undergrowth is a malware POC templating tool. Useful if you want to try to invoke shellcode from disk or reflection it in more evasive ways.

Undergrowth uses 128-bit AES encryption and a randomly generated IV to encrypt shellcode then decrypt it in memory. Templates may be private or public.

Supported Injection Templates

  • CreateRemoteThread
  • MapViewofSection
  • UUID

Additional Tools

Grunt Obfuscator

Roadmap

  • APCQueueInject
  • SRDI
  • Loaded DLL Hollowing
  • Phantom DLL Hollowing
  • Fiber Shellcode Execution
  • ACG Functionality
  • Dynamically resolved syscalls
  • Non Emulated API execution support
Additional Payload Obfuscators - Beacon, Merlin

For a better understanding of the 'why' review: https://www.forrest-orr.net/post/masking-malicious-memory-artifacts-part-iii-bypassing-defensive-scanners