May 09, 2026, 10:04 PM
[HEADING=1]AV-Bypass // Current Progress[/HEADING]
Hello, I've been wokring on my so called 'FUD Loader'
As of now It works like that :
I've made Multiple ways to embed an executable as a PE resource, drop, and launch it in runtime.
After that, I have a manual loader to Allocate memory for executing shellcode later.
(1. Allocate Memory, 2. Move Shellcode into that Memory, Execute Shellcode)
To generate the Shellcode I used Windows x64 assembly shellcode, using PEB walking and dynamic API resolving.
There is many more steps including those :
Obfuscation, Process injection, Detect virtual machines (Sandbox), From PE to shellcode and then to From .exe (build with .net) to .exe hidden.
For the obfusacation I tried my best to make the following features as good as I could get them :
Packing
Polymorph
Signature hiding
CFG
Change date of compilation
Bypass AMSI
(Static)
Whilst the injector is just simple DLL injection.
I don't think I have to explain the VM-Detections here, as a little kid would know how to detect those.
Sadly this is not enough to bypass all AV-Detections, if anyone has anything to add or share, I'd love to hear it
Hello, I've been wokring on my so called 'FUD Loader'
As of now It works like that :
I've made Multiple ways to embed an executable as a PE resource, drop, and launch it in runtime.
After that, I have a manual loader to Allocate memory for executing shellcode later.
(1. Allocate Memory, 2. Move Shellcode into that Memory, Execute Shellcode)
To generate the Shellcode I used Windows x64 assembly shellcode, using PEB walking and dynamic API resolving.
There is many more steps including those :
Obfuscation, Process injection, Detect virtual machines (Sandbox), From PE to shellcode and then to From .exe (build with .net) to .exe hidden.
For the obfusacation I tried my best to make the following features as good as I could get them :
Packing
Polymorph
Signature hiding
CFG
Change date of compilation
Bypass AMSI
(Static)
Whilst the injector is just simple DLL injection.
I don't think I have to explain the VM-Detections here, as a little kid would know how to detect those.
Sadly this is not enough to bypass all AV-Detections, if anyone has anything to add or share, I'd love to hear it