[KevenLionardo]

Handles Packed EXEs – Many implementations choke on compressed/encrypted binaries. Mine unpacks them in memory before injection, so UPX, Themida, or custom packers don't break the flow.

Works Amazing With XMR Miners And Other Miners. 😋

Works x64/x86  .NET/Native


https://pastebin.com/raw/UzsYtiUu

[closedeyeknight]

I tried Process Hollowing or RunPE etc kinda tech, all killed by av/edr. Does it still work?

[KevenLionardo]

I tried Process Hollowing or RunPE etc kinda tech, all killed by av/edr. Does it still work?

with the Process Hollowing code i shared it's possible to bypass with a little changes and don't forget to pack your .exe file so modafoking AV's like ESET EDR can't see/scan memory page, returns clean but not "#" example.

you got the idea?

i'm smart ASF :D you can also before using that process hollowing you can code simple loader that loads in memory then pack then use process hollowing. this Bypasses AVAST/AVG Sandbox 15 seconds instantly returns clean


~ i love malware since 2013 and i love nanocore rat

[closedeyeknight]

with the Process Hollowing code i shared it's possible to bypass with a little changes and don't forget to pack your .exe file so modafoking AV's like ESET EDR can't see/scan memory page, returns clean but not "#" example.

you got the idea?

i'm smart ASF :D you can also before using that process hollowing you can code simple loader that loads in memory then pack then use process hollowing. this Bypasses AVAST/AVG Sandbox 15 seconds instantly returns clean


~ i love malware since 2013 and i love nanocore rat

Wow! thank you for sharing this