[I_H8_KDot]

Overlord has been out for about 3 months now. This is what the detections look like.

https://kleenscan.biz/runtime/scan_resul...3fbc11f753

NO CRYPT.

https://kleenscan.biz/runtime/scan_resul...b41dd4a506

THIS IS NORMAL DONUT WITH NO AMSI PATCH.

MANY people come to my dms and complain about an open source project having detections but I can assure you that with a little shellcode magic or common crypting practices, you can refud Overlord within 15 minutes and have a version that won't get detected for weeks.

[loadman]

Since it’s open source it’s more likely to get flagged over time. A custom morpher would probably be more reliable and easy for you in the long run,, but yea i respect the effort that you are doing for everyone without taking anything in return ++++

[possessed-client]

Ah, you got a unique signature, at least from Nod32, congrats on the milestone!

Btw, what did you use to execute the Donut-produced shellcode file, if it's something custom then what chain of techniques and methods?

[d3athgiver]

Overlord has been out for about 3 months now. This is what the detections look like.

https://kleenscan.biz/runtime/scan_resul...3fbc11f753

NO CRYPT.

https://kleenscan.biz/runtime/scan_resul...b41dd4a506

THIS IS NORMAL DONUT WITH NO AMSI PATCH.

MANY people come to my dms and complain about an open source project having detections but I can assure you that with a little shellcode magic or common crypting practices, you can refud Overlord within 15 minutes and have a version that won't get detected for weeks.

Some people forgot venom was around 3k and needed crypting and fully detected and lot of others paid rat can cost over 1k, are windows only and also require crypting... I know only 1 other rat multi os and it's not free lol. I am using that rat for a while without crypt and keep having new connection with very basic technique lol

[CL1B]

Ah, you got a unique signature, at least from Nod32, congrats on the milestone!

Btw, what did you use to execute the Donut-produced shellcode file, if it's something custom then what chain of techniques and methods?

They've been flagging pretty much every decently built project deriving from HF since 2025, safe to say one of their researchers is rather active HF member.

[DramaKing]

It's still good to use crypting and anti-reverse-engineering. Yes, it's open-source but good practice.

[benio2]

This won't bypass smartscreen or chrome browser. The only reason it's bypassing in the runtime scans is because it's dropping the file to desktop from it's own filesystem. Try your payload on defender in a vm, upload your shit in a zip file on mediafire or something similar. Use latest version of chrome to dl. Bet chrome catches it or smartscreen will catch it before it even runs. So this means the only way your payload truly bypasses is if you plug in a usb, which a lot of smart companies prohibit.

[I_H8_KDot]

This won't bypass smartscreen or chrome browser. The only reason it's bypassing in the runtime scans is because it's dropping the file to desktop from it's own filesystem. Try your payload on defender in a vm, upload your shit in a zip file on mediafire or something similar. Use latest version of chrome to dl. Bet chrome catches it or smartscreen will catch it before it even runs. So this means the only way your payload truly bypasses is if you plug in a usb, which a lot of smart companies prohibit.

Well that's because it doesn't matter how good your crypt is it will always still get caught on chrome (specifically when running after) due to MOTW. Just download tho? It's fine. But MOTW will fuck up when someone tries running it. The only way to get past this is to get a sig or end up on Microsoft's good boy list which is way harder than you'd imagine.

[benio2]

Well that's because it doesn't matter how good your crypt is it will always still get caught on chrome (specifically when running after) due to MOTW. Just download tho? It's fine. But MOTW will fuck up when someone tries running it. The only way to get past this is to get a sig or end up on Microsoft's good boy list which is way harder than you'd imagine.

Stick a vulnerable exe with a hijacked dll inside an iso file, then zip the iso file. Download it from mediafire with chrome. Go test that in a vm. It will bypass mark of the web and smartscreen.😵 better than signing a fresh .exe, much harder to detect a .dll payload. Some av companies have caught on though and pretty much automatically block exe files loading a dll inside a container.

The best way is a browser/legitimate software exploit that drops a .dll into a vulnerable folder, it would use search order hijacking to find a path where a vulnerable .exe is looking for a .dll, it wouldnt drop any exe (imagine onedrive launches it searches for random dll in %appdata%, your dll would be that file)

[I_H8_KDot]

Stick a vulnerable exe with a hijacked dll inside an iso file, then zip the iso file. Download it from mediafire with chrome. Go test that in a vm. It will bypass mark of the web and smartscreen.😵 better than signing a fresh .exe, much harder to detect a .dll payload. Some av companies have caught on though and pretty much automatically block exe files loading a dll inside a container.

The best way is a browser/legitimate software exploit that drops a .dll into a vulnerable folder, it would use search order hijacking to find a path where a vulnerable .exe is looking for a .dll, it wouldnt drop any exe (imagine onedrive launches it searches for random dll in %appdata%, your dll would be that file)

Ok I don't think you understand half the things that you're saying.

When you say "vulnerable exe with a hijacked dll inside an iso file" you're just referring to sideloading. This works and is basically the ONLY way you can bypass MOTW without weird archive strats (hence the iso but this has been fixed by windows). Also no. It's not better than signing an exe. If you make a proper crypt that's binded and you sign it, it'll work much better. sideloading is also getting cracked down on by Defender with it's new AI updates. Obviously if you don't want to pay the 4k for a cert then your only choice is to use sideloading but I can assure you that a cert is the MUCH better option for anyone with money.

[benio2]

Ok I don't think you understand half the things that you're saying.

When you say "vulnerable exe with a hijacked dll inside an iso file" you're just referring to sideloading. This works and is basically the ONLY way you can bypass MOTW without weird archive strats (hence the iso but this has been fixed by windows). Also no. It's not better than signing an exe. If you make a proper crypt that's binded and you sign it, it'll work much better. sideloading is also getting cracked down on by Defender with it's new AI updates. Obviously if you don't want to pay the 4k for a cert then your only choice is to use sideloading but I can assure you that a cert is the MUCH better option for anyone with money.

No it's not. It bypasses defender just fine. If you find a unique hijack that isn't blacklisted it will even bypass much better av with out wasting your time and money on certs. Although signing an exe is a good way it's easier to detect after sandbox analysis. Drop a dll through an exploit so you can live off the land by abusing a phantom dll or search order. A java exploit that simply downloads a dll into the folder that you specify.

You should add undetectable in memory interactive mimikatz to pulsar 2.4.6 and release 2.4.7. This would be cool in legal red team engagements.

[DramaKing]

This won't bypass smartscreen or chrome browser. The only reason it's bypassing in the runtime scans is because it's dropping the file to desktop from it's own filesystem. Try your payload on defender in a vm, upload your shit in a zip file on mediafire or something similar. Use latest version of chrome to dl. Bet chrome catches it or smartscreen will catch it before it even runs. So this means the only way your payload truly bypasses is if you plug in a usb, which a lot of smart companies prohibit.

Bypassing Chrome Safe Browsing with new malware is easy. I think that it works by checking URLs against a blacklist and running downloaded files against AMSI and the active AV engine. The focus should always be AV evasion, not browser evasion.

SmartScreen triggers on any untrusted unsigned file with MotW. How many people go "Oh no, an unrecognized app! I'd better get rid of this now!" SmartScreen "catching" a downloaded file is understood.

It sounds like you're just trashing Overlord. Who in the target audience only spreads to companies, too?

[benio2]

Bypassing Chrome Safe Browsing with new malware is easy. I think that it works by checking URLs against a blacklist and running downloaded files against AMSI and the active AV engine. The focus should always be AV evasion, not browser evasion.

SmartScreen triggers on any untrusted unsigned file with MotW. How many people go "Oh no, an unrecognized app! I'd better get rid of this now!" SmartScreen "catching" a downloaded file is understood.

It sounds like you're just trashing Overlord. Who in the target audience only spreads to companies, too?

It has nothing to do with overlord. I see people posting scans claiming their it bypasses when in reality it doesn't. Chrome browser scan is also checking for random ass freshly generated .exe files.

[DramaKing]

It has nothing to do with overlord. I see people posting scans claiming their it bypasses when in reality it doesn't.

KDot wouldn't post fake AV results for something that he gives away for free. Feel free to download the RAT and run your own scans.

---

Chrome browser scan is also checking for random ass freshly generated .exe files.

Plainly wrong. Never has Chrome ever popped up a message saying "Download blocked. File is too new."

[benio2]

KDot wouldn't post fake AV results for something that he gives away for free. Feel free to download the RAT and run your own scans.

---

Plainly wrong. Never has Chrome ever popped up a message saying "Download blocked. File is too new."

Yes because that's not the message it says. It blocks the file and says it's malicious.