Bypass Windows Defender with FilelessPELoader - Mimikatz and Meterpreter

Be better than yesterday -

This video showcases how a publicly available tool in C++, the FilelessPELoader, can be used to bypass the latest Windows Defender with all features turned on. The C++ FilelessPELoader fetches an AES encrypted executable (.EXE) file and the key remotely via HTTP from a server, and performs the decryption and execution directly in memory. This prevents the malicious .EXE file from being written onto disk.

Gemini Security Awesome Hacking T-Shirts - Support the channel:

All credits belong to the author of the tool:

Timestamp:
00:00 Intro
01:41 FilelessPELoader C++ Compilation
03:31 Successful demonstration of Mimikatz
04:11 Successful demonstration of Meterpreter Reverse Shell

Stay connected:

[cristigdv]

Not working anymore. Flagged by windows AV. Thanks anyway

[asldkfjzopiuqea]

why wont it work on a client from quasar, but it does work with a msfvenom payload?

[NextMOVEtv.]

Hi bro, I tried a pentesting, after converting the exe.file to crypter and key bin. How can this payload be installed

[CrazyCreed_]

Hey bro, I"ve been watching your videos from a couple of days and i liked your videos❤ pls make videos on remote hacking, rubber ducky payloads, burpsuit and metasploit :) love from India💝💝

[novianindy]

hi, is it detected by most AV now?
the one that got detected is the PE Loader? or the payload? why payload cant be detected?

[Xeno-hdrj]

Hello, I'm probably missunderstanding something here but what's the point of this loader if you need to install something on the victim's machine and run commands before getting a shell/exploit ? like if you can compile and run the c++ file you already have an access on the machine in one way or another so what's the point ? Post exploit and Persistance on already pawned machines ?

great video thx for your work

[vendra]

Is there a method that can be done without using linux? Using only functions that are on windows?