Founding: The Next-Gen Loader Generator for Advanced Evasion
Founding is a tool that processes shellcode in .bin, .exe, or .dll formats, applying advanced obfuscation or encryption techniques to generate stealthy binaries with sophisticated execution methods.
Features
Core Features (Applied in Every Compilation)
- Dynamic API Hashing
Generates unique hash values for API functions at runtime to evade detection. - IAT Camouflage
Invokes select Windows API functions to enhance binary legitimacy. - Minimal CRT
Removes the CRT Library for precise control over the Import Address Table. - Watermark
Embeds custom watermarks in DOS Stub, Checksum, PE Section, or file overlay. - Resource File
Embeds file properties resemblingcleanmgr.exefor authenticity. - Preamble 0xFC 0x48
PrependsxFCx48to shellcode to bypass static analysis.
Encryption and Obfuscation
- Supports IPv4/IPv6/MAC/UUID obfuscation.
- Offers XOR, RC4, and AES encryption.
- Includes payload padding for extra obfuscation.
- Generates random encryption keys per run.
Generators Types
- Raw
Directly processes.binpayloads. - Donut
Uses Donut to create.binwithout AMSI bypass. - Clematis
Employs Clematis for.binwith garble obfuscation and compression. - Powershell-donut
Converts.exeto.binusing PS2EXE and Donut.
Execution types
- APC
Executes via Asynchronous Procedure Calls. - Early-Bird-Debug
Uses APC with a remote debug or suspended process. - EnumThreadWindows
Leverages the EnumThreadWindows callback function. - Local-Mapping-Inject
Performs local mapping with a suspended thread. - Early-Cascade
Hooksntdll!SE_DllLoadedfor payload execution. - Fibers
Switches execution contexts without new threads. - Process-Hypnosis
Runs payload in a debugged child process, then detaches. - Tp-Alloc
Queues shellcode using Thread Pool API (TpAllocWait/TpSetWait). - Local-Hollowing
Duplicates and runs PE in a suspended main thread.
Optional features
Indirect Syscalls
- Hells-Hall
Change all implementation to Indirect Syscalls (HellsHall) including optional flags. - Syswhispers3
Change all implementation to Indirect Syscalls (SysWhispers3) including optional flags.
Compiler
- Clang-LLVM
Use Clang-LLVM obfuscation to evade static analysis.
AMSI Bypasses
- Amsi-Opensession
PatchAmsiOpenSessionto return invalid argument. - Amsi-Scanbuffer
PatchAmsiScanBufferto return invalid argument. - Amsi-Signature
PatchAmsiSignatureto return invalid string corrupting the signature value. - Amsi-Codetrust
PatchWldpQueryDynamicCodeTrustto return invalid argument.
Unhooking
- Unhooking-Createfile
Unhook all functions fromntdll.dllmapped withCreateFileMappingA. - Unhooking-Knowndlls
Unhook all functions fromntdll.dllfrom KnownDlls directory. - Unhooking-Debug
Unhook all functions fromntdll.dllcopying the new NTDLL from a new debug process. - Hookchain
Modifies the IAT to reroute function calls, allowing it to intercept and handle them.
ETW Bypasses
- Etw-Eventwrite
PatchEtwEventWriteFull,EtwEventWrite, andEtwEventWriteExto blind EDR telemetry. - Etw-Trace-Event
PatchNtTraceEventto blind EDR telemetry. - Etw-pEventWriteFull
Patch private functionEtwpEventWriteFullto return invalid parameters to blind EDR telemetry.
Sandbox Bypasses
- Api-Hammering
Creates a random file, reads/writes random data, delaying execution for 10 sec. - Delay-Mwfmoex
UseMsgWaitForMultipleObjectsExdelaying execution for 10 sec. - Fibonacci
Calculate Fibonacci delaying execution for 10 sec. - Mouse-Clicks
Logs clicks for 20 seconds; if fewer than 1 click, assumes sandboxed environment. - Resolution
Checks resolution for sandbox environments. - Processes
Checks if the system is running less than 50 processes; assumes sandboxed environment. - Hardware
Checks if the system has less than 2 processors, 2 GB RAM, and 2 USBs mounted; assumes sandboxed environment.
Payload Control
- Check-Running
Check if the executable is already running; if so, prevent duplicate execution. - Self-Delete
Ensure the payload deletes itself during execution; if deletion fails, deletes file content reducing its size to zero bytes.
Miscellaneous
- Dll
Create a DLL with optional export function name (default:runme), runsrundll32in background. - Dll-Stealthy
Create a stealthier DLL with optional export function name (default:runme). - Service
Create an executable to be run as a service. - Inflate
Inflate the executable with random Portuguese words to increase its size. - Sign
Sign the final executable with a certificate. - No-Window
Run without opening a terminal window. - No-Print
Run without printing any output, remove allprintfs from implementation. - Decoy
Embed a decoy file (e.g., PDF) to be executed alongside the payload.
Download & Use
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.