EmmaSmith1987
Well-known member
- Joined
- Jul 19, 2025
- Messages
- 10
- Reaction score
- 0
- Points
- 100
- Awards
- 1
Key Features
1. Advanced Payload Generation
- Customizable VBA Macros: Generate tailored VBA scripts for Word, Excel, and PowerPoint, allowing precise control over payload behavior.
- Obfuscation Techniques: Built-in obfuscation to evade antivirus detection by randomizing function names and encoding payloads (e.g., Base64 encoding for executables).
- Multi-Stage Payloads: Supports complex infection chains, such as downloading secondary payloads via HTTPS or PowerShell scripts for persistence.
- Mark of the Web (MOTW) Evasion: Manipulates or removes MOTW metadata to bypass Microsoft’s default macro-blocking for internet-originated files.
- Sandbox Escape: Exploits legitimate Office features like Dynamic Data Exchange (DDE) to execute code without triggering macro-specific defenses.
- AMSI Bypass: Circumvents Microsoft’s Antimalware Scan Interface by disabling runtime script scanning or using unsigned macros.
- Realistic Document Templates: Pre-built lures mimicking invoices, reports, or HR forms to trick users into enabling macros.
- Customizable Prompts: Craft convincing “Enable Content” prompts to increase user interaction rates.
- Cross-Platform Compatibility: Supports attacks on Windows and macOS, including zero-click exploits for older Office versions.
- Metasploit Compatibility: Seamlessly integrates with Metasploit to generate reverse HTTPS payloads and handle command-and-control (C2) communications.
- Sliver Support: Uses Sliver for cross-platform implants, reducing detection by leveraging Golang-based payloads.
- Open-Source Tools: Compatible with MacroPack and other obfuscation frameworks for enhanced payload stealth.
- Behavioral Analysis Simulation: Tests endpoint detection and response (EDR) systems by simulating malicious macro behaviors like process injection or fileless execution.
- Detailed Logging: Generates comprehensive logs of payload execution, user interactions, and detection bypasses for post-test analysis.
- Policy Testing: Validates Group Policy settings, Trust Center configurations, and macro-blocking rules in enterprise environments.