HadesLdr

A demo of the relevant blog post: Combining Indirect Dynamic Syscalls and API Hashing

Shellcode Loader Implementing :

• Indirect Dynamic Syscall by resolving the SSN and the address pointing to a backed syscall instruction dynamically.
• API Hashing by resolving modules & APIs base address from PEB by hashes
• Fileless Chunked RC4 Shellcode retrieving using Winsock2

Demo :

met.mp4

References :

https://github.com/am0nsec/HellsGate/tree/master
https://cocomelonc.github.io/tutorial/2022/04/02/malware-injection-18.html
https://blog.sektor7.net/#!res/2021/halosgate.md