GhosltyGamer
Member
- Thread Author
- #1
You must be registered for see images attach
PEunion encrypts executables, which are decrypted at runtime and executed in-memory.
- Stub:
- Native: Written in assembly (FASM)
- .NET: Written in C#
- Emulator detection
- Low-entropy packing scheme
- Two-layer execution architecture
- Code obfuscation
- File compression
- Binder (combine multiple files)
- Downloader
- RunPE (process hollowing)
- In-memory invocation of .NET executables