LogansBestFriend

LogansBestFriend is a practical modification of the simple shellcode loader "GregsBestFriend" from WhiteKnightLabs, which uses regex to bypass sandbox detections.

LogansBestFriend's configuration does not pop a debug CMD window and executes as a background process, as well as decrypts stager shellcode in memory.

Stager shellcode in the C format can be encrypted by using:

#include <stdio.h>

unsigned char code[] = "\x90\x90\x90";

int main()
{

    char key[] = "key"; //Enter key here
    int keylen = strlen(key);
    int i = 0;
    for (i; i < sizeof(code); i++) {
        printf("\\x%02x",code[i]^key[i % keylen]);
    }
 
}