# Skrull | A Malware DRM, That Prevents Automatic Sample Submission By AV/EDR And Signature Scanning From Kernel

**URL:** <https://onehack.st/t/skrull-a-malware-drm-that-prevents-automatic-sample-submission-by-av-edr-and-signature-scanning-from-kernel/213685>\
**Category:** Tools & Scripts\
**Tags:** tools, documents\
**Created:** [February 3, 2022, 9:28am UTC](https://onehack.st/t/skrull-a-malware-drm-that-prevents-automatic-sample-submission-by-av-edr-and-signature-scanning-from-kernel/213685 "2022-02-03T09:28:56Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Hannah](https://onehack.st/user_avatar/onehack.st/hannah/32/174875_2.png) [@Hannah](https://onehack.st/u/Hannah)\
**Post date:** [February 3, 2022, 9:28am UTC](https://onehack.st/t/skrull-a-malware-drm-that-prevents-automatic-sample-submission-by-av-edr-and-signature-scanning-from-kernel/213685/1 "2022-02-03T09:28:56Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/d/1/d1d9d79c9569e7c6dd0ef419939bf8a54ae44374.jpeg)

Skrull is a malware DRM, that prevents Automatic Sample Submission by AV/EDR and Signature Scanning from Kernel. It generates launchers that can run malware on the victim using the Process Ghosting technique. Also, launchers are totally anti-copy and naturally broken when got submitted.

It’s a proof-of-concept of the talk of ROOTCON & HITCON 2021, check out _[Skrull Like A King: From File Unlink to Persistence](https://rootcon.org/html/rc15/talks#skull_like_a_king)_ and _[Skrull Like A King：從重兵看守的天眼防線殺出重圍](https://hitcon.org/2021/agenda/fde63a27-5814-4058-83c9-d3788327f200/)_🙂

**note that currently support only x64 PE now, due to the ghosting technique.**

## Video Demo

[![](https://camo.githubusercontent.com/d6f1477e7be1ab10f982f433250612b6612a4e97c6c89f2d3edd5a356b471046/68747470733a2f2f696d672e796f75747562652e636f6d2f76692f70526a52776c39746a58732f302e6a7067)](https://www.youtube.com/watch?v=pRjRwl9tjXs)

## GitHub:

> **[GitHub - aaaddress1/Skrull: Skrull is a malware DRM, that prevents Automatic...](https://github.com/aaaddress1/Skrull)**
>
> Skrull is a malware DRM, that prevents Automatic Sample Submission by AV/EDR and Signature Scanning from Kernel. It generates launchers that can run malware on the victim using the Process Ghosting technique. Also, launchers are totally anti-copy and naturally broken when got submitted.