Data center: Ashburn, VA

Telegram Chat : MBHH_x86

Email Us:

Mobile Hacker For Hire, hire a hacker, hiring a hacker, hacker with proof

A Payload Loader Designed With Advanced Evasion Features

Table of Contents

TerraLdr: A Payload Loader Designed With Advanced Evasion Features


  • no crt functions imported
  • syscall unhooking using KnownDllUnhook
  • api hashing using Rotr32 hashing algo
  • payload encryption using rc4 – payload is saved in .rsrc
  • process injection – targetting ‘SettingSyncHost.exe’
  • ppid spoofing & blockdlls policy using NtCreateUserProcess
  • stealthy remote process injection – chunking
  • using debugging & NtQueueApcThread for payload execution


Thanks For:


  • “SettingSyncHost.exe” isnt found on windows 11 machine, while i didnt tested with w11, its a must to change the process name to something else before testing
  • it is possibly better to compile with “ISO C++20 Standard (/std:c++20)”


Demo (by @ColeVanlanding1) :

Tested with cobalt strike && Havoc on windows 10

Leave a Reply

Your email address will not be published. Required fields are marked *

error: Content is protected !!