PEzoNG: Advanced Packer For Automated Evasion - Dimitri Di Cristofaro - Giorgio Bernardinetti
Title: PEzoNG: Advanced Packer For Automated Evasion On Windows
Speakers: Dimitri Di Cristofaro and Giorgio Bernardinetti
A fully undetectable (FUD) executable is a highly coveted goal in cybersecurity field, especially in the case of Red Teams. In this talk we present the design and implementation of PEzoNG, a framework for automatic creation of FUD binaries in a Windows environment.
PEzoNG features a custom loader for Windows binaries, polymorphic obfuscation, a payload decryption process and a number of anti-sandbox and anti-analysis evasion mechanisms - in particular we present a novel userland unhooking technique. In addition, the custom loader supports a large amount of Windows executable files, and features stealth and bleeding-edge memory allocation schemes. Finally we show the effectiveness of PEzoNG over a number of commercial anti-malware solutions. PEzoNG was born from the idea of PEzor (https://github.com/phra/PEzor), an open-source PE packer. At the time of writing PEzoNG is a completely different project from PEzor, though they still share a part of the name and the building environment, made up of LLVM and clang.
PEzoNG is a project written in C and C++ and uses the Mingw-w64 development environment together with the LLVM toolchain in order to compile and link.
PEzoNG source code is made up of three main components:
the malicious payload, e.g. Cobalt Strike Raw Shellcode, Mimikatz, SharpHound, etc.
the evasion code, which allows to evade from AV Sandboxes and EDRs
the main loader, which loads the malicious payload into memory and executes it.
PEzoNG is built with modularity in mind and allows to add new features in a simple way by adding new modules that could implement different techniques with a low grained detail.
The project is organized in the following macro-categories - or modules:
Encryption
Windows APIs
Syscalls
Evasion
PE loader
Shellcode injection
Red Team Village Website: https://redteamvillage.io
Discord: https://redteamvillage.io/discord
Twitter: https://redteamvillage.io/twitter