Video Demonstrates C Malware Development and Shellcode Staging Against Windows Defender

Summary

A video demonstrates a C loader downloaded over HTTP that retrieves reverse-shell shellcode over SMB and runs it in memory on Windows. The presenter reports Defender alerted but did not stop the shell; testing was limited to Defender.

Key points

The video presents a hands-on C malware-development demonstration framed as a lab or penetration test.
The presenter describes generating reverse TCP shellcode with MSF Venom and configuring a listener on port 80.
The loader is transferred to the Windows system over HTTP, then retrieves shellcode over SMB, allocates executable memory, and runs it.
The presenter reports that Defender did not detect the loader at download, but alerted after execution without removing the binary or stopping the shell.
The presenter says the method was tested only against Defender and may fail against other EDR products; the demonstrated workflow did not use sandboxing, syscalls, or encryption.

Article Details

Topics: [00:00] C malware development demonstration
[00:37] Malware concepts, C2 implants, and EDR monitoring
[05:14] Evasion concepts including staging, sandboxing, syscalls, and encryption
[07:14] Lab setup and reverse-shell payload generation
[09:47] SMB staging and loader code walkthrough
[13:35] Allocating memory and executing staged shellcode
[16:01] HTTP delivery and the Windows Defender test

MITRE ATT&CK

T1059.001 · PowerShellPowerShell is used to download the loader and run commands during the demonstrated shell session.T1105 · Ingress Tool TransferThe demonstration transfers a loader over HTTP and retrieves shellcode over SMB onto the Windows system.

Products

Kali Linux[07:36] infrastructure. We have a Kali system,Microsoft Windows[00:03] patched Windows machine with Windows Windows Defender[07:31] So, we have the Windows Defender there,

Tools

MSF Venom[08:25] be MSF Venom, but you can follow the Sliver[04:20] for a sliver, for example. Or this can