tunnelgre/augustus

Evasive Golang Loader

Augustus

Evasive Golang Loader

Augustus is a Golang loader that execute shellcode utilizing the process hollowing technique with anti-sandbox and anti-analysis measures. The shellcode is encrypted with the Triple DES (3DES) encryption algorithm.

Full EDR bypass with any C2 Framework. Tested with Cobalt Strike against MDE EDR.

Key Features:

• 3DES Encryption
• Sandbox Evasion
• Analysis Evasion
• Execution delay
• Process Hollowing

TIP: I recommended to sign the binary with CS

CS:

MSF:

augustus's Issues

seems to be not working

Hello, I was testing it with different Cobalt strike payloads but didn't get any logs or sessions on my VM's. Compilation was without problems or errors. Could u provide some advice how to start it correctly?

Provide examples of shellcode generation

Thanks for the tool, would it be possible to provide examples of shell-code generation, i have been trying multiple approaches, but no dice in getting shellcode execution, i have tried simple msgbox, and other more complex with CS and MSF.

Here are my steps i have used.

• Payloads tested (metasploit, x64 reverse_shell_tcp, x86_reverse_shell_tcp, msgbox, adduser) everything generated in C format
• Tested with Cobalt Strike 4.8, C staged and stageless shellcodes
• go version go1.21.0 linux/amd64
• go run 3DESEncryptor.go, and then enter the values in the main.go at the specific places for IV, SC, KEY
• no specific sandboxing processes are running that could break the execution flow
• Compile "env GOOS=windows GOARCH=amd64 go build -x -trimpath -o ./main.exe main.go"
• No connectivity issue, it can reach internet or the local network.
• Execute on the victim machine, no reverse shell or no pop-ups.
• Machines are Windows 10 Updated, administrative access, 8gb of ram 4 cpu, 128gb of hard drive.

Again thanks for your help