Dropper - GitLite

KO | EN

gitlite — search

#typescript #llm #android #rust #deep-learning #docker #macos #windows #awesome #cli #awesome-list #vue #security #open-source

Dropper

(★ 67)

Embed an executable as a PE resource, drops and launches it in runtime.

파일 탐색기

최종 버전 다운로드 (.zip)

- - Hellobin.sln
- - HelloDll.sln
- - NewHello.sln
- README.md
- Dropper.sln
- README.md
- Dropper.sln
- README.md
- - Dropper.vcxproj
  - resource.h
  - Resource.rc
  - Source.cpp
- Dropper.sln
- README.md
- - Dropper.vcxproj
  - resource.h
  - Resource.rc
  - Source.cpp
- - Dropper.dll
- Dropper.sln
- README.md
- roots_mlsec20.pdf
- roots_shallow.pdf
- basexor.py
- encode.py
- exports.py
- patch.py
- README.md
LICENSE
README.md

# 설치 가이드

1. 코드 내려받기

git clone https://github.com/marcusbotacin/Dropper

깃허브에서 프로젝트 코드 전체를 내 컴퓨터로 내려받습니다.

cd Dropper

방금 내려받은 프로젝트 폴더 안으로 이동합니다.

2. .NET

보통 추천

사전 준비물

Git GitHub에서 프로젝트 코드를 내려받으려면 필요합니다.
.NET SDK dotnet 명령어를 쓰기 위한 SDK입니다.

cd bin.samples/HelloDll

이 프로젝트의 관련 파일이 하위 폴더 안에 있어서, 먼저 그 폴더로 이동합니다.

dotnet restore

프로젝트에 필요한 패키지를 내려받습니다.

dotnet run

프로젝트를 빌드하고 바로 실행합니다.

✅ dotnet run 실행 후 터미널에 나타나는 안내 메시지나 주소를 확인하세요.

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# Dropper

Multiple ways to embed an executable as a PE resource, drop, and launch it in runtime.

Created for educational purposes. Use at your own risk!

## Available Material

* The *filesystem.exe* directory hosts a project for an EXE binary that drops tha payload to the filesystem and creates the process from it.
* The *filesystem.dll* directory hosts a project for a DLL binary that drops tha payload to the filesystem and creates the process from it.
* The *inmemory.dll* directory hosts a project for a DLL binary that drops a payload to a copy of its own process' memory.
* The *inmemory.filesystem.dll* directory hosts a project for a DLL binary that drops a payload to the disk and replace it in memory with another payload also extracted from itself.
* The *bin.samples* directory hosts sample binaries for testing purposes.
* The *utils* directory hosts helper functions.

## Usage

This dropper has been used in my (our) participation in the MLSEC competition [link here](https://mlsec.io/)

The *Adversarial Malware in Machine Learning Detectors: Our MLSEC 2020’s SECRETs* blog post describing our 2020's participation is available [here](https://secret.inf.ufpr.br/2020/09/29/adversarial-malware-in-machine-learning-detectors-our-mlsec-2020-secrets/)

## Publications

The article *Shallow Security: on the Creation of Adversarial Variants to Evade Machine Learning-Based Malware Detectors* published in the *Reversing and Offensive-oriented Trends Symposium 2019 (ROOTS)* made use of this dropper. [Check Here](paper/roots_shallow.pdf).

The article *No Need to Teach New Tricks to Old Malware: Winning an Evasion Challenge with XOR-based Adversarial Samples* published in the *Reversing and Offensive-oriented Trends Symposium 2020 (ROOTS)* made use of this dropper. [Check Here](paper/roots_mlsec20.pdf).