Cyber security

MaldevAcademyLdr.1 – Advanced EXE Loader Unveiled

It is our latest innovation in cybersecurity tools. This EXE loader goes beyond conventional designs, offering advanced features for robust system interactions.

With a focus on enhanced security and sophisticated integration capabilities, it’s set to revolutionize the way users interface with executable files.

EXE Loader

Maldev Academy’s October update saw several interesting modules being released to our users. One of them was our DLL loader that was successfully tested against several EDRs including MDE and Crowdstrike.

We promised to release an EXE version of the loader on GitHub.

Features

  • Indirect-Syscalls using an improved HellsHall implementation.
  • Dll Unhooking via the \KnownDlls\ directory
  • Payload injection by chunking
  • Using custom AES encryption library.
  • Executing payload via Thread Pool APIs.
  • Obfuscating IAT using API hashing and API camouflage.
  • CRT library independent.

Demo

Varshini

Varshini is a Cyber Security expert in Threat Analysis, Vulnerability Assessment, and Research. Passionate about staying ahead of emerging Threats and Technologies.

Recent Posts

How to Prevent Software Supply Chain Attacks

What is a Software Supply Chain Attack? A software supply chain attack occurs when a…

1 day ago

How UDP Works and Why It Is So Fast

When people ask how UDP works, the simplest answer is this: UDP sends data quickly…

2 weeks ago

How EDR Killers Bypass Security Tools

Endpoint Detection and Response (EDR) solutions have become a cornerstone of modern cybersecurity, designed to…

2 weeks ago

AI-Generated Malware Campaign Scales Threats Through Vibe Coding Techniques

A large-scale malware campaign leveraging AI-assisted development techniques has been uncovered, revealing how attackers are…

2 weeks ago

How Does a Firewall Work Step by Step

How Does a Firewall Work Step by Step? What Is a Firewall and How Does…

2 weeks ago

Fake VPN Download Trap Can Steal Your Work Login in Minutes

People trying to securely connect to work are being tricked into doing the exact opposite.…

2 weeks ago