Malicious Macro Generator
 
 
Go to file
Rahmat Nurfauzi 1c3747bd7b
Update wmi-msbuild-evasion-domain-template.vba
2018-06-22 08:57:46 +07:00
configs Create wmi-msbuild-evasion-domain.json 2018-06-21 08:26:24 +07:00
examples Create generic-cmd-evasion.vba 2016-11-11 15:31:15 -05:00
lib Update encoder.py 2017-10-18 17:44:04 -04:00
templates Update wmi-msbuild-evasion-domain-template.vba 2018-06-22 08:57:46 +07:00
LICENSE.md Update LICENSE.md 2017-10-13 18:28:41 -04:00
MMG.py Update MMG.py 2016-11-11 22:44:53 -05:00
README.md Update README.md 2017-08-03 14:42:47 -04:00
TEMPLATE.md Update TEMPLATE.md 2016-12-13 20:41:48 -05:00

README.md

Malicious Macro Generator Utility

Simple utility design to generate obfuscated macro that also include a AV / Sandboxes escape mechanism.

Requirement

Python 2.7

Usage

MMG.Malicious Macro Generator v2.0 - RingZer0 Team
Author: Mr.Un1k0d3r

Usage: MMG.py [config] [output] (optional -list)

        config  Config file that contain generator information
        output  Output filename for the macro
        -list   List all available payloads and evasion techniques

python MMG.py configs/generic-cmd.json malicious.vba

Config file

Example of a project config file.

{
	"description": "Generic command exec payload\nEvasion technique set to domain check",
	"template": "templates/payloads/generic-cmd-evasion-template.vba",
	"varcount": 150,
	"encodingoffset": 4,
	"chunksize": 200,
	"encodedvars": 	{
				"DOMAIN":"RINGZER0"
			},
	"vars": 	[],
	"evasion": 	["encoder", "domain"],
	"payload": "cmd.exe /c whoami"
}

Evasion techniques

Domain check

The macro is fetching the USERDOMAIN environment variable and compare the value with a predefined one. If they match the final payload is executed.

Disk check

The macro is looking for the total disk space. VMs and test machines use small disk most of the time.

Memory check

The macro is looking for the total memory size. Vms and test machines use less resources.

Uptime check

The macro is looking for the system uptime. Sandboxes will return a short uptime.

Process check

The macro is checking if a specific process is running (example outlook.exe)

Obfuscation

The python script will also generate obfuscated code to avoid heuristic detection

More to come

Credit

Mr.Un1k0d3r RingZer0 Team

https://ringzer0team.com