About The Tool

DarkWidow is a customizable dropper tool targeting a EDR enabled windows environment. It has various EDR evasive functionalities built into it which would help Red Teamers to get an initial access into a EDR enabled windows target. It uses indirect system call implementation along with powerful APC Early Bird to CUT OFF telemetry Catching by EDR. Malware protecting configurations so that EDR can't really inject its EDR dll into our dropper malware. PPID spoofing is there to hide under the radar of detection of malicious parent-child process relationship. Dynamic resolving of cursed NTApi and dll indirectly from TIB (not the normal approach of availing from PEB) and also not to mention the NTApis and Dll's are hashed. Lastly, it would have synthetic frame thread stack spoofing (active spoofing) enabled into it in order to evade ETWTi telemetry catching. Also this tool is highly customizable due to it's built in code structure.