# APCLdr | Payload Loader With Evasion Features

**URL:** <https://onehack.st/t/apcldr-payload-loader-with-evasion-features/234879>\
**Category:** Tools & Scripts\
**Tags:** tools, hacking\
**Created:** [March 23, 2023, 11:04pm UTC](https://onehack.st/t/apcldr-payload-loader-with-evasion-features/234879 "2023-03-23T23:04:07Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![BlueHacker](https://onehack.st/user_avatar/onehack.st/bluehacker/32/174721_2.png) [@BlueHacker](https://onehack.st/u/BlueHacker)\
**Post date:** [March 23, 2023, 11:04pm UTC](https://onehack.st/t/apcldr-payload-loader-with-evasion-features/234879/1 "2023-03-23T23:04:07Z")

</div>

![wpm_apc](https://onehack.st/uploads/default/original/3X/c/c/ccf3a8403127e5ba321a1fe084efb4d5a9178940.gif)

## APCLdr: Payload Loader With Evasion Features

### Features:

- no crt functions imported
- indirect syscalls using [HellHall](https://github.com/Maldev-Academy/HellHall)
- api hashing using [CRC32](https://github.com/NUL0x4C/APCLdr/blob/main/APCLdr/Win32.c#L111) hashing algorithm
- payload encryption using rc4 - payload is saved in .rsrc
- Payload injection using APC calls - alertable thread
- Payload execution using APC - alertable thread
- Execution delation using [MsgWaitForMultipleObjects](https://github.com/NUL0x4C/APCLdr/blob/main/APCLdr/APCLdr.c#L66) - edit [this](https://github.com/NUL0x4C/APCLdr/blob/main/APCLdr/Common.h#L6)
- the total size is 8kb + the payload size
- compatible with **LLVM (clang-cl)** Option

### Usage:

- Use [Builder](https://github.com/NUL0x4C/APCLdr/tree/main/Builder) to update the [PayloadFile.pf](https://github.com/NUL0x4C/APCLdr/blob/main/APCLdr/PayloadFile.pf) file, that’ll be the encrypted payload to be saved in the .rsrc section of the loader
- Compile as x64 Release

### Debugging:

- Change _Linker\>SubSystem_ from **/SUBSYSTEM:WINDOWS** to **/SUBSYSTEM:CONSOLE**
- Set the loader in debug mode (uncomment [this](https://github.com/NUL0x4C/APCLdr/blob/main/APCLdr/Debug.h#L7))
- build as release as well

### Thanks For:

- [https://www.x86matthew.com/view\_post?id=writeprocessmemory\_apc](https://www.x86matthew.com/view_post?id=writeprocessmemory_apc)
- [https://github.com/vxunderground/VX-API](https://github.com/vxunderground/VX-API)

#### Tested with cobalt strike && Havoc on windows 10

## GitHub:

[https://github.com/NUL0x4C/APCLdr](https://github.com/NUL0x4C/APCLdr)