<div style="margin:20px 0 0 200px"> To view the site, enable JavaScript by changing your browser options, then <a href="">Try Again</a>.</div>

Xencrypt - A PowerShell Script Anti-Virus Evasion Tool

05 Mar, 2020
Xencrypt - A PowerShell Script Anti-Virus Evasion Tool

Tired of wasting lots of time obfuscating PowerShell scripts like invoke-mimikatz only to have them get detected anyway? Wouldn't it be awesome if you could take any script and automatically and with almost no effort generate a near-infinite amount of variants in order to defeat signature-based antivirus detection mechanisms?

WELL, NOW YOU CAN! For the low low price of free! Xencrypt is a PowerShell crypter that uses AES encryption and Gzip/DEFLATE compression to with every invocation generate a completely unique yet functionally equivalent output script given any input script. It does this by compressing and encrypting the input script and storing this data as a payload in a new script which will unencrypt and decompress the payload before running it. In essence, it is to PowerShell what a PE crypter is.

In action

Xencrypt - A PowerShell Script Anti-Virus Evasion Tool

Xencrypt - A PowerShell Script Anti-Virus Evasion Tool

Features

Xencrypt:
  • Bypasses AMSI and all modern AVs in use on VirusTotal (as of writing)
  • Compresses and encrypts powershell scripts
  • Has a minimal and often even negative (thanks to the compression) overhead
  • Randomizes variable names to further obfuscate the decrypter stub
  • Randomizes encryption, compression and even the order that the statements appear in the code for maximum entropy!
  • Super easy to modify to create your own crypter variant
  • Supports recursive layering (crypter crypting the crypted output), tested up to 500 layers
  • Supports Import-Module as well as standard running as long as the input script also supported it
  • GPLv3 -- Free and open-source!
  • All features in a single file so you can take it with you anywhere!
  • Is despite all of the above not a silver bullet for every configuration -- caveat emptor!

Usage

Import-Module ./xencrypt.ps1
Invoke-Xencrypt -InFile invoke-mimikatz.ps1 -OutFile xenmimi.ps1

You will now have an encrypted xenmimi.ps1 file in your current working directory. You can use it in the same way as you would the original script, so in this case:

Import-Module ./xenmimi.ps1
Invoke-Mimikatz

It also supports recursive layering via the -Iterations flag.

Invoke-Xencrypt -InFile invoke-mimikatz.ps1 -OutFile xenmimi.ps1 -Iterations 100

This will compress and encrypt it 100 times and is useful for dynamic AV bypasses because they have a time-out for analyzing code. There's no fakery here like sleeps that the dynamic scan can skip to get to the end -- it has to go through the entire chain to get to the malicious payload which it usually never does since they normally time out after a second or two or scanning.

Warning though, the files can get big and generating the output file can take a very long time depending on the scripts and number of iterations requested.

Authors

Xentropy ( @SamuelAnttila )
SecForce ( @SECFORCE_LTD )

Download Tool: https://github.com/the-xentropy/xencrypt

Other Hacking Tools

Explore All Hacking Tools »

Exclusive Blog

Read All Exclusive Blog »
Android Banking Trojan targets over 232 banking apps, including Indian banks
Cyber Criminals are turning into Cryptominers, Dominating Cyber Threat Landscape

According to Check Point, during the period July to December 2017, one in five Organizations are affected by crypto mining malware, tools that enable cybercriminals to hijack the victim's CPU or GPU power and existing resources to mine cryptocurrency, using as much as 65% of the end-users CPU power.

Read Details

Breaking News

Breaking News Of Each Month »
85 password stealing apps found on Google Playstore
85 password stealing apps found on Google Playstore

Security researchers discovered malicious apps designed to steal credentials from users have been downloaded million times from Google play store. Among these, the most popular app is a gaming app.

Read Details