$ show watanabe-hsad/GoPhantom
GoPhantom is a Go-based Windows loader generator designed for security research. It creates executables that embed and decrypt payloads and decoy files while employing various evasion techniques to avoid detection. The application takes input files (decoy and payload), encrypts them, generates Go source code using templates that incorporate the encrypted data and selected security features, then compiles this code for Windows/amd64. The resulting executable can showcase the decoy file to the user while executing the payload through techniques like process injection, API hashing, direct syscalls, memory protection evasion, and module stomping to make malicious code appear as legitimate DLL code. The project is explicitly archived and no longer actively developed, as stated in the README.
The LLM identified 2 files worth highlighting for reuse:
Implements secure key derivation using Argon2id with a static password for deterministic key generation when salt is provided via environment variable. Also provides environment-bound key derivation that ties decryption keys to specific system characteristics (hostname, domain, username, etc.), ensuring the payload only decrypts in the target environment. This self-contained package demonstrates sound cryptographic practices and could be extracted for use in any application requiring secure key management or environment-specific execution.
Defines a structured knowledge base of evasion techniques with metadata including technique ID, name, description, category, involved Windows APIs, complexity rating, and code snippets with placeholders for string obfuscation. Provides lookup functions by ID, ID list, or category. This well-organized component demonstrates excellent organization of security knowledge and could be reused in any security research tool that needs to catalog and reference evasion techniques.