SharpVenoma icon indicating copy to clipboard operation
SharpVenoma copied to clipboard

CSharp reimplementation of Venoma, another C++ Cobalt Strike beacon dropper with custom indirect syscalls execution

SharpVenoma



C# reimplementation of Venoma


Another C# Cobalt Strike beacon dropper with custom indirect syscalls execution




> A custom CSharp raw beacon dropper with :

> DLL Unhooking (Perun's fart)
> ETW Patching
> AMSI Patching
> EnumPageFilesW execution
> Early Bird APC Execution
> Indirect syscall execution
>

All functions are included, choose what you need and remove anything else before compiling.




Usage


Generate your raw payload and use the aes.py file to encrypt the data :



Update the source code and choose what you want to execute :