bytecode77/pe-union

Crypter, binder & downloader with native & .NET stub, evasive by design, user friendly UI

r77 Rootkit

Fileless ring 3 rootkit

• Hides processes, files, network connections, etc.
• Out of the box, single file installer
• Fileless persistence, in-memory injection

PEunion

Crypter, binder & downloader

• In-memory decryption & execution
• Two-layer execution architecture

Living Off The Land

State of the art fileless attacks

• Execution without any files
• Process injection
• Persistence

... It's technically not even there

pe-union's Issues

crash with files larger than 15MB

why? tried many times, binder closes after a LONG build loading (file 22mb + 1mb)

Modify Stub / Private fud

Looking for tips on where to start making a private stub for FUD crypt.

use a .Net Stub with an Invoke action

Help me.

Not fully undetectable

I wanted to test this and noticed that:

Unencryped - 43/70 engines detected it.
Encrypted - 39/70 engines detected it.

There isn't much change...

encrypter ! FUD

Hello

Can i use it as just a crypter to make my exe undetectable ?
i have tried to encrypter xmrig miner but the final build doesn't work
btw really Nice tool

.Net Stub with an Invoke action

Hello!
Can you show me what this stub code should look like to use RunPE option?
I am newbie

File dropper

Is there a way to not use the file dropper?

getting error like something

Great Tool and Suggestions for 4.0

This isn't an issue but I'm just telling you this tool is very good and I appreciate you will continue to update it after 4 years. However I have a suggestion to the new version which you are working on. It would be great to see that you could change the dropping location to a custom one eg. in the system folder. This is because the preset ones are very bad for tech savvy users, they could open task manager and find the file location. Also the UI design is very nice compared to other Binders and Crypters.
Great Job and best of luck to you

Marshal.GetDelegateForFunctionPointer

I used ThreatCheck to perform static analysis on a built file and Trojan:MSIL/DCRat.J!MTB was detected
Probably this line in API.cs was causing the problem

dependency

can u share all .net dependency's i m not sure way after installing .net as instructed pe dos not start i dont know its win7 or something else

Problem with the download file from url option

I have a problem with the download file from url option. the file is downloaded, but it is not saved in its original form, it has much less kilobytes and therefore does not run. Tested on various upload sites.

App crashes

Hello there, when i try to compile 2 apps/exe's. It runs through the compiling and then later crashes. I'm left with a process running for C# taking up to 90% of my memory.

support for x64 native stub

Hello sir, it's a really awesome tool. Could you please add x64 native stub, so that I can runpe my x64 pe file.

Doesn't Work

When binding multiple files for example
if I bind my exe with a portable software which depends on its files in that folder.
It doesn't get executed or end up broken I tried the portable.exe execution directory option still nothing and the other file gets executed with a huge delay like 1 minute later.

Fully detectable

Hello and thank you for reading and replying to my problem.
I've binded 2 files [one .exe around 40kb and one .txt around 3.5MB, both separated by an error appearing image]. I only selected encrypt, compress and hidden for the executable I'm interested in, and also selected ,,run as administrator'' execution in the ,exe's config prior to building it. After building it, zipping it with winrar and uploading it online, I tried to download it through google drive/anon files and many other upload sites, I can't even get to the point that I got it In my PC, can't say anything about even unzipping the folder. This is what i get:

Basically there's no chance that anyone could even try to open that folder. Can I have some advice? Bless.

Issues compiling.

When I try to compile the file I get the error shown here,

CS2001: Source file 'dir*\AppData\Local\Temp\tmp2D4.tmp' could not be found

*my windows directory does have a space in it, maybe that is to blame?

Any help is appreciated.
Thank you.

Stub.cs

i downloaded binary and runed it, added file and tryied to build it, line 0 CS2001 on every try descripton Stub.cs

Crypt

If I do not know if the .exe that I am gluing is encrypted and if I turn on the cryptor during the gluing, will the files work if they have already been encrypted?

Detected by Windows Defender

No matter what I try to do, the file is detected by windows defender as "Trojan:Win32/Wacatac.B!ml" in version 4.0

video hướng dẫn

hi vọng bạn ra video hướng dẫn sử dụng cho tool này, và cho hỏi là nó có vượt qua" windows defender? "

New to C#

I am new to C++ and C#. I have been a webdeveloper for years, but in the field of C and C# I have little to no experience. Do you have any idea how I can get resrouces on learning about crypters and stub.

While I was researching I found this repo, but I don't really know how I should get started. On Google and youtube there is very little information available as far as I know.

Any suggestions?

modifying stub

first of all i'd love to thank you for the immense work u've made :)

so u've said that only the stub needed modification to be FUD. but i dont know where to look at in the code lmao.

when i open the pe-union.sln file in VS, could u give me some indication as where to look at ? (peunion, pebuild or pe compiler folder?

im relatively new to this game, sorry if it seems to be a dumb question.

also if u have some tips to make it FUD i'd love to hear from a pro.

thanks for everything

RunPE,Invoke error

Cannot use .NET executable file.exe with RunPE.
And when i use Invoke gives me this error:
.NET Invocation is only supported in a .NET stub.
How can i fix that?

Question abt editing stub

Hello I am new to coding in general. I am wondering in what way can I edit the stub to make it a different signature so it is FUD again?

command line support

Hello @bytecode77 !

Any plans on adding CLI / command line support for your tool? :)
I would love to add support for it in my ProtectMyTooling but currently cannot do so due to inability to invoke it from CLI.

Or is it pebuild.exe I should use to invoke it instead? I'm unsure.

Happy Christmas,
Mariusz.