This is only for native 32 and 64 bit paylods, .NET payloads aren't supported as of right now
Detections at the time of post:
(https://www.virustotal.com/gui/file/f7d74306e806f36dd3a6b3693c722741eb6b10604157986822c36820d7d93a9a)
Featurestwo‑stage crypter + loader for Windows executables. It consists of two separate components:
Features
Detections at the time of post:
(https://www.virustotal.com/gui/file/f7d74306e806f36dd3a6b3693c722741eb6b10604157986822c36820d7d93a9a)
Features
- crypt – a command‑line tool that encrypts an input PE file, performs integrity checks, and outputs an encrypted payload together with a key.
- stub – a loader that embeds the encrypted payload as a resource, applies extensive anti‑analysis measures (anti‑VM, unhooking, ETW/AMSI bypass, indirect syscalls, sleep obfuscation), and finally reflects the original PE into memory and executes it.
- Run crypt on a target .exe → produces encrypted_Input.bin (Base85‑encoded ciphertext) and key.txt (the 32‑byte master key).
- Copy encrypted_Input.bin to stub/encrypted_Input.bin and key.txt to stub/src/key.txt, then build the stub. The build script embeds the encrypted payload as a resource, and the resulting stub.exe is a fully standalone loader that decrypts and runs the original payload in memory.
Features