Releases: ProcessusT/LoadThat-PEandAssembly
Releases · ProcessusT/LoadThat-PEandAssembly
Word Dictionary Edition
This release introduces a polymorphic PE loader embedding a mimikatz x64 payload encoded via a 10,000-word English dictionary.
Each byte is mapped to a unique word, split into randomly-sized shuffled chunks, and reconstructed at runtime.
Improvements over previous editions:
- Word dictionary byte encoding — defeats static pattern matching
- Polymorphic chunking — random chunk sizes & shuffled order
- SHA-256 Proof-of-Work (~40–50s) — bypasses sandbox timeouts
- Stack strings — sensitive API names built char-by-char at runtime
- Full identifier randomization — unique binary on every generation
- PE metadata spoofing — MSVC linker, randomized timestamp, Rich header wiped
- Authenticode signature theft — borrowed from PsExec64
- Dynamic API resolution — no suspicious imports
Disclaimer: This release is purely for educational and research purposes. Use responsibly.