search

MythicAgents / atlas

13 stars 7 forks source link

ConfuserEx Obfuscation Option #3

Closed kyleavery closed 3 years ago

kyleavery commented 3 years ago

This PR adds an additional configuration option when building the Atlas agent. image The default is "false", and will result in a payload that is no different than it would have been before this feature. Setting obfuscation to "true" will run the output Atlas.exe through the following CEX profile:

<rule pattern="true" preset="normal" inherit="false">
  <protection id="watermark" action="remove" />
  <protection id="ctrl flow" action="remove" />
  <protection id="ref proxy" action="remove" />
</rule>

To give you an example of CEX, the output executable will have an entry point that looks like this: image The payload shouldn't get caught by Defender or AMSI if this option is used, but the file size increases quite a bit (~62KB to ~130KB).

kyleavery commented 3 years ago

The CEX binary and libraries came from this release: https://github.com/mkaring/ConfuserEx/releases/tag/v1.5.0

kyleavery commented 3 years ago

Maybe ignore this for now. May rewrite as a wrapper payload to work with Apollo as well.