An academic study on how a proxy DLL can impersonate a legitimate library while loading and executing an encrypted payload — without touching hooked Win32 APIs, without leaving RWX memory, and without writing a single byte to ntdll.
Overview GHOUL is an educational Command & Control (C2) framework built on top of the Discord REST API. The project covers the full stack: a Windows agent written in C, and an operator bot written in Python using discord.py. The goal was to build something that goes beyond a toy example — implementing real techniques used by modern implants, with every design decision documented and explained. The result is a working C2 with encrypted beaconing, multiple AV/EDR evasion layers, and a per-agent interactive shell system, all over a transport that blends into normal network traffic. ...