# AceLdr | Cobalt Strike UDRL For Memory Scanner Evasion

**URL:** <https://onehack.st/t/aceldr-cobalt-strike-udrl-for-memory-scanner-evasion/231003>\
**Category:** Tools & Scripts\
**Tags:** tools, programming, privacy\
**Created:** [January 8, 2023, 8:41pm UTC](https://onehack.st/t/aceldr-cobalt-strike-udrl-for-memory-scanner-evasion/231003 "2023-01-08T20:41:02Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![TheStrength](https://onehack.st/user_avatar/onehack.st/thestrength/32/46753_2.png) [@TheStrength](https://onehack.st/u/TheStrength)\
**Post date:** [January 8, 2023, 8:41pm UTC](https://onehack.st/t/aceldr-cobalt-strike-udrl-for-memory-scanner-evasion/231003/1 "2023-01-08T20:41:03Z")

</div>

# AceLdr - Avoid Memory Scanners

A position-independent reflective loader for Cobalt Strike. Zero results from [Hunt-Sleeping-Beacons](https://github.com/thefLink/Hunt-Sleeping-Beacons), [BeaconHunter](https://github.com/3lp4tr0n/BeaconHunter), [BeaconEye](https://github.com/CCob/BeaconEye), [Patriot](https://github.com/joe-desimone/patriot), [Moneta](https://github.com/forrest-orr/moneta), [PE-sieve](https://github.com/hasherezade/pe-sieve), or [MalMemDetect](https://github.com/waldo-irc/MalMemDetect). [![AceLdr Demo](https://github.com/kyleavery/AceLdr/raw/main/demo.gif)](https://github.com/kyleavery/AceLdr/blob/main/demo.gif)

## Features

#### Easy to Use

Import a single CNA script before generating shellcode.

#### Dynamic Memory Encryption

Creates a new heap for any allocations from Beacon and encrypts entries before sleep.

#### Code Obfuscation and Encryption

Changes the memory containing CS executable code to non-executable and encrypts it (FOLIAGE).

#### Return Address Spoofing at Execution

Certain WinAPI calls are executed with a spoofed return address (InternetConnectA, NtWaitForSingleObject, RtlAllocateHeap).

#### Sleep Without Sleep

Delayed execution using WaitForSingleObjectEx.

#### RC4 Encryption

All encryption performed with SystemFunction032.

## Known Issues

- Not compatible with loaders that rely on the shellcode thread staying alive.

## References

This project would not have been possible without the following:

- [FOLIAGE](https://github.com/secidiot/FOLIAGE)
- [x64 return address spoofing (source + explanation)](https://www.unknowncheats.me/forum/anti-cheat-bypass/268039-x64-return-address-spoofing-source-explanation.html)

Other features and inspiration were taken from the following:

- [https://www.arashparsa.com/bypassing-pesieve-and-moneta-the-easiest-way-i-could-find/](https://www.arashparsa.com/bypassing-pesieve-and-moneta-the-easiest-way-i-could-find/)
- [https://github.com/secidiot/TitanLdr](https://github.com/secidiot/TitanLdr)
- [https://github.com/JLospinoso/gargoyle](https://github.com/JLospinoso/gargoyle)
- [https://www.forrest-orr.net/post/masking-malicious-memory-artifacts-part-ii-insights-from-moneta](https://www.forrest-orr.net/post/masking-malicious-memory-artifacts-part-ii-insights-from-moneta)
- [https://www.arashparsa.com/hook-heaps-and-live-free/](https://www.arashparsa.com/hook-heaps-and-live-free/)
- [https://blog.f-secure.com/hunting-for-gargoyle-memory-scanning-evasion/](https://blog.f-secure.com/hunting-for-gargoyle-memory-scanning-evasion/)
- [https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures](https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures)

## GitHub:

[https://github.com/kyleavery/AceLdr](https://github.com/kyleavery/AceLdr)