TerraLdr: A Payload Loader Designed With Advanced Evasion Features


  • no crt functions imported
  • syscall unhooking using KnownDllUnhook
  • api hashing using Rotr32 hashing algo
  • payload encryption using rc4 – payload is saved in .rsrc
  • process injection – targetting ‘SettingSyncHost.exe’
  • ppid spoofing & blockdlls policy using NtCreateUserProcess
  • stealthy remote process injection – chunking
  • using debugging & NtQueueApcThread for payload execution


Thanks For:


  • “SettingSyncHost.exe” isnt found on windows 11 machine, while i didnt tested with w11, its a must to change the process name to something else before testing
  • it is possibly better to compile with “ISO C++20 Standard (/std:c++20)”


aab971b3266f8ec93ff390634ee3a18866cf96fa811e8459c17ba8a25cc600e1 86beb40341fb74734d52fa66a2758f9fd86f5bb010bf9f076b74e9b9828df212

Demo (by @ColeVanlanding1) :


Tested with cobalt strike && Havoc on windows 10

Original Source

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon using the button below

Digital Patreon Wordmark FieryCoralv2

To keep up to date follow us on the below channels.

Click Above for Telegram
Click Above for Discord
Click Above for Reddit
hd linkedin
Click Above For LinkedIn

By admin