{"repo":"chainski/PandaLoader","free":true,"listed":false,"github":"https://github.com/chainski/PandaLoader","clone":"git clone https://github.com/chainski/PandaLoader.git","description":"A WIP shellcode loader tool which bypasses AV/EDR, coded in C++, and equipped with a minimal builder.","language":"C++","stars":88,"topics":["bypass-antivirus","edr-bypass","etw-bypass","etw-evasion","evasion","malware","obfuscation","pe-loader","powershell","shellcode"],"license":"MIT","category":"cli-tools","readme_excerpt":"PandaLoader PandaLoader is a WIP shellcode loader designed to evade detection by using various anti-analysis techniques and features such as virtual machine (VM) detection, process injection, and payload decryption. Features How It Works Anti-VM Checks (IF ENABLED IN BUILDER) Before loading the shellcode, PandaLoader performs extensive anti-VM checks to determine if it's running in a virtualized environment. This includes: - Process Scanning: It checks for the presence of specific processes associated with VM environments (e.g., vboxmouse.sys , vmwareuser.exe ). File and Directory Scanning: It searches for files and directories related to VM tools , such as VirtualBox or VMware . Machine Process Count: It checks if the number of running processes is below 100, which could indicate a VM or sandbox environment. ETW (Event Tracing for Windows) Patch: It patches functions related to ETW to prevent the logging of events, which could be used for analysis. If any VM indicators are detected, the loader will terminate. - Payload Retrieval : The shellcode is downloaded from a remote URL specified in the SHELLCODE URL when using the builder. It uses the WinINet API to download the payload into a std::vector buffer. - Payload Decryption : The decryption key is specified by the XOR DECRYPTION KEY which is the one generated using the builder. The decryption is performed by the XORDecrypt() function, which iterates through the payload and XORs each byte with the corresponding byte in the ke","default_branch":null,"files":null,"tree":[],"storefront":"/r/chainski","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/chainski/PandaLoader/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}