Test your red team payloads against EDR systems in a controlled lab environment
Learn how malware evasion techniques like module stomping and sleep obfuscation work
Study anti-analysis methods that block debuggers, sandboxes, and virtual machines
Benchmark detection tools against a loader designed to evade modern EDR
| xec412/xeraldr | nettitude/clr-stomp | syscallx-18113/apkx-hunter | |
|---|---|---|---|
| Stars | 71 | 72 | 70 |
| Language | C | C | C |
| Setup difficulty | moderate | hard | moderate |
| Complexity | 4/5 | 5/5 | 3/5 |
| Audience | researcher | ops devops | ops devops |
Figures from each repo's GitHub metadata at analysis time.
Requires Visual Studio with C/C++ build tools and a Windows x64 environment to compile from source.
XeraLdr is a Windows program built by a single developer (username xec412) for a very specific niche: red team security research and malware development. It is a "loader," which is software whose job is to run a hidden payload (such as a reverse shell) on a target machine without being caught by Endpoint Detection and Response (EDR) systems like Microsoft Defender for Endpoint. The README is explicit that the project is for educational and research purposes only, and that using it against systems you do not own is illegal. The author reports that it was tested against Microsoft Defender for Endpoint and produced no alerts after several hours of activity. The repository documents several technical methods used to evade detection. One is "module stomping," where the program overwrites a legitimate system library in memory to hide its own code in a trusted space. Another is sleep obfuscation using stack duplication and heap encryption, which makes the program harder to find when it is idle. The binary is built without the standard Visual C++ Runtime to keep its file size small and its system footprint minimal. The payload itself is encrypted using ChaCha20 and encoded, so it stays unreadable until the moment it runs. Additional protections include anti-analysis checks that prevent the loader from running inside virtual machines, debuggers, or sandboxes, which are tools security analysts use to study suspicious software. The README also references "IAT camouflage" and "proxy execute" functions, both aimed at reducing suspicious patterns that monitoring software looks for. The author links to external resources like Maldev Academy and references other GitHub projects for sandbox detection and cryptography libraries. The README includes build instructions. A user clones the repository, opens the provided solution file in Visual Studio, selects the Release x64 configuration, and rebuilds the solution. The project is licensed under GPL-3.0. Screenshots in the repository show the disguised import table, the call stack during execution, and a successful reverse shell session. The documentation is clear about one caveat: the sleep obfuscation only works with a persistent payload that keeps running, not with a transient program like a calculator app.
XeraLdr is a Windows tool for red team security researchers that secretly runs hidden payloads while evading detection by security monitoring software like Microsoft Defender for Endpoint.
Mainly C. The stack also includes C, Visual Studio, Windows.
Free to use and modify, but any distributed versions must also be open-source under the same GPL-3.0 terms and include source code.
Setup difficulty is rated moderate, with roughly 30min to a first successful run.
Mainly researcher.
This repo across BitVibe Labs
Verify against the repo before relying on details.