This is a Python-based registry exploit generator designed to inject malicious payloads into the Windows startup process via the registry. It includes base64-encoded PowerShell payloads and optional obfuscation to avoid detection by antivirus software.
PhantomReg allows you to create registry files (.reg) that modify Windows startup to run a malicious PowerShell script. The payload is encoded to avoid detection, and the program offers obfuscation options to make the exploit harder for security tools to detect.
The generated .reg file adds entries to the Windows registry (Shell and Userinit) to run a PowerShell command that executes the payload on system startup. The script can be used for educational purposes or to simulate malicious payloads in a controlled environment.
Features
Base64-Encoded Payload: The PowerShell script is base64-encoded to avoid detection by basic text-based scanners.
Obfuscation: The payload can be obfuscated with random byte insertion, making it harder to detect by antivirus software.
Customizable Filename: Choose a misleading name for the .reg file to make it harder to identify as malicious.
Support for Custom Payloads: You can inject custom binary payloads into the registry file.
OS: Windows
Download:
PhantomReg allows you to create registry files (.reg) that modify Windows startup to run a malicious PowerShell script. The payload is encoded to avoid detection, and the program offers obfuscation options to make the exploit harder for security tools to detect.
The generated .reg file adds entries to the Windows registry (Shell and Userinit) to run a PowerShell command that executes the payload on system startup. The script can be used for educational purposes or to simulate malicious payloads in a controlled environment.
Features
Base64-Encoded Payload: The PowerShell script is base64-encoded to avoid detection by basic text-based scanners.
Obfuscation: The payload can be obfuscated with random byte insertion, making it harder to detect by antivirus software.
Customizable Filename: Choose a misleading name for the .reg file to make it harder to identify as malicious.
Support for Custom Payloads: You can inject custom binary payloads into the registry file.
OS: Windows
Download:
