PandaCrypter is a C#-based tool designed to convert PowerShell scripts into obfuscated batch files (.bat) with encryption and additional features for execution control.
Features
AES Encryption: Encrypts the PowerShell payload.
Anti-VM: Optionally evades virtualized environments.
Compression: Compresses the payload to reduce size before encryption.
Obfuscation: Obfuscates the generated batch file and powershel execution chain.
AMSI Bypass: Optionally includes an AMSI (Antimalware Scan Interface) bypass to avoid detection.
Run as Administrator: Supports elevating privileges by prompting for admin rights using Abuse Elevation Control Mechanism Force Admin.
Self-Deletion: Optionally self-destructs after execution.
Persistence: Optionally registers the batch file to run at user logon via scheduled tasks.
Windows Defender Exclusion: Can add an exclusion path to Windows Defender (requires admin privileges).
Execution Delay: Supports adding a delay before script execution.
Low Entropy Packing: Contains colon padding to reduce entropy
EventLog Cleanup: Removes Powershell logs to reduce footprint (requires admin privileges).
How It Works
PandaCrypter processes a PowerShell script through several stages to produce an obfuscated batch file:
Input Reading: Reads the input PowerShell script (.ps1) as text.
Compression: Compresses the script using GZip to reduce its size.
Encryption: Encrypts the compressed payload.
Stub Generation: Creates a PowerShell stub that:
Decodes the encrypted payload from Base64.
Decrypts it using the provided key and IV.
Decompresses the result.
Executes the final PowerShell code using IEX (Invoke-Expression).
Batch Obfuscation: Embeds the PowerShell stub in a batch file, applying:
Random variable names for obfuscation.
Splitting commands into smaller parts assigned to variables.
Random case variation for PowerShell command strings (e.g., pOwErShElL).
Feature Integration: Adds optional features like AMSI bypass, admin elevation, or self-deletion based on command-line flags.
Output: Writes the final batch file with the encrypted payload appended as a Base64-encoded string, prefixed with :: .
author
Chainski
Chainski Inc.
Canada
Link:
