Locked Chimera - Automated DLL Sideloading Tool With EDR Evasion Capabilities

[itsMe]

This is the hidden content, please

• Sign In
• or
• Sign Up

Tool Background

While DLL sideloading can be used for legitimate purposes, such as loading necessary libraries for a program to function, it can also be used for malicious purposes. Attackers can use DLL sideloading to execute arbitrary code on a target system, often by exploiting vulnerabilities in legitimate applications that are used to load DLLs.

To automate the DLL sideloading process and make it more effective, Chimera was created a tool that include evasion methodologies to bypass EDR/AV products. These tool can automatically encrypt a shellcode via XOR with a random key and create template Images that can be imported into Visual Studio to create a malicious DLL.

Also Dynamic Syscalls from SysWhispers2 is used and a modified assembly version to evade the pattern that the EDR search for, Random nop sleds are added and also registers are moved. Furthermore Early Bird Injection is also used to inject the shellcode in another process which the user can specify with Sandbox Evasion mechanisms like HardDisk check & if the process is being debugged. Finally Timing attack is placed in the loader which using waitable timers to delay the execution of the shellcode.

This tool has been tested and shown to be effective at bypassing EDR/AV products and executing arbitrary code on a target system.

Additional Options

     [raw payload file] : Path to file containing shellcode
     [output path] : Path to output the C template file
     [process name] : Name of process to inject shellcode into
     [dll_exports] : Specify which DLL Exports you want to use either teams or onedrive
     [replace shellcode variable name] : [Optional] Replace shellcode variable name with a unique name
     [replace xor encryption name] : [Optional] Replace xor encryption name with a unique name
     [replace key variable name] : [Optional] Replace key variable name with a unique name
     [replace sleep time via waitable timers] : [Optional] Replace sleep time your own sleep time

This is the hidden content, please

• Sign In
• or
• Sign Up

This is the hidden content, please

• Sign In
• or
• Sign Up