🦑Windows Defender Bypass 2024 with AES-Encrypted Malicious DLL.

Hello everyone,
Since a lot of you guys enjoyed the last video, I decided to create another bypass technique—this time using AES encryption for the shellcode. To make it more interesting, I incorporated the shellcode into a malicious DLL and executed it using another process.

Here’s how it works:

I created a simple file, test.exe (the process I mentioned), which loads the malicious DLL containing the encrypted shellcode. This is achieved using the LoadLibraryA() function and the GetProcAddress() function which is essential for loading any DLL and their exported functions into a process's memory. Once loaded, the DLL decrypts and executes the shellcode.

This time malicious DLL contained raw encrypted shellcode stored on disk. The encryption prevents detection by Windows Defender. In my previous approach, the shellcode was hosted on a server, making it a staged payload. While experimenting, I also tried XOR to obfuscate the shellcode like last time. However, it was consistently detected for some reason I still don’t understand.XORing the shellcode and AES encrypting it share a similar concept though.I might be wrong on this one, forgive me if I am.

This method can be implemented in various ways. One approach is to inject the DLL into another process using its PID or using this AES method to just execute the malicious exe to run the shellcode in memory without loading the dll. This technique has been used by APTs as a means of achieving persistence on compromised systems they target.

I used multiple resources from the internet. All the code used do not belong to me. I added custom logic(like calling the exported function) and tweaked it a little bit to make it work like the way I wanted it to. I give credit to the internet.Hope you guys find this useful!

Ref: Dhanush Arvind
@UndercodeCommunity
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

The #Samsung Music Frame: A Stylish Smart Speaker with a Bargain

https://undercodenews.com/the-samsung-music-frame-a-stylish-smart-speaker-with-a-bargain/

@Undercode_News

Play #Ransomware Targets South Plains Implement

https://undercodenews.com/play-ransomware-targets-south-plains-implement/

@Undercode_News

🔐 #Ransomware Attack Hits Joshua Grading & Excavating

https://undercodenews.com/ransomware-attack-hits-joshua-grading-excavating/

@Undercode_News

Everest and Play #Ransomware Groups Target Healthcare and Consulting Firms

https://undercodenews.com/everest-and-play-ransomware-groups-target-healthcare-and-consulting-firms/

@Undercode_News

#Ransomware Groups Target Dental Practices and Consulting Firms

https://undercodenews.com/ransomware-groups-target-dental-practices-and-consulting-firms/

@Undercode_News

Informative Israeli Tech IPOs: A Promising 2025

https://undercodenews.com/informative-israeli-tech-ipos-a-promising-2025/

@Undercode_News

⚡️ 2nd One UI 7 Beta: A Closer Look at the Latest Features and Improvements

https://undercodenews.com/2nd-one-ui-7-beta-a-closer-look-at-the-latest-features-and-improvements/

@Undercode_News

#Ransomware Group Hunters Targets Ecritel

https://undercodenews.com/ransomware-group-hunters-targets-ecritel/

@Undercode_News

🕵️ Gamaredon Leverages #Android #Spyware to Target Former Soviet States

https://undercodenews.com/gamaredon-leverages-android-spyware-to-target-former-soviet-states/

@Undercode_News

Israel's High-Tech Sector: A Beacon of Hope in Turbulent Times

https://undercodenews.com/israels-high-tech-sector-a-beacon-of-hope-in-turbulent-times/

@Undercode_News

⚡️ OnePlus Open 2: A Promising Upgrade on the Horizon

https://undercodenews.com/oneplus-open-2-a-promising-upgrade-on-the-horizon/

@Undercode_News

💾 How Startups Can Drive Insurance Innovation to Mitigate Climate Crises

https://undercodenews.com/how-startups-can-drive-insurance-innovation-to-mitigate-climate-crises/

@Undercode_News

#AI Video Generation Takes a Leap: #Google DeepMind Unveils Veo 2

https://undercodenews.com/ai-video-generation-takes-a-leap-google-deepmind-unveils-veo-2/

@Undercode_News

Informative #Samsung Care+ Gets Even Better: Free Screen Replacements

https://undercodenews.com/informative-samsung-care-gets-even-better-free-screen-replacements/

@Undercode_News

A Humorous Take on Flatmate Hunting

https://undercodenews.com/a-humorous-take-on-flatmate-hunting/

@Undercode_News

⚡️ Ignite Rises from the Ashes: A New Deep-Tech Innovation

https://undercodenews.com/ignite-rises-from-the-ashes-a-new-deep-tech-innovation/

@Undercode_News

🚨 Critical Vulnerabilities Added to CISA's Known Exploited Vulnerabilities Catalog

https://undercodenews.com/critical-vulnerabilities-added-to-cisas-known-exploited-vulnerabilities-catalog/

@Undercode_News

🛡️ Israeli Defense Tech's American Dream: The Paragon Sale

https://undercodenews.com/israeli-defense-techs-american-dream-the-paragon-sale/

@Undercode_News