OPSEC by architecture
Compile-time hardening, per-build polymorphism, clean image-backed stacks across every execution path.
Evasion is not a plugin or a kit bolted onto a standard agent. In ApeX it is resolved at build time from a per-build polymorphism seed. There is no runtime initialization overhead, and no two binaries share byte-level patterns. Every feature below is a build-time flag; stealth profiles compose from them.
One seed, one unique binary
$ apex build --target win-x64 --profile stealth
agent zig-build
seed 7a2c4d8e9f1b5a3e2d7f8c6b4a9e1d5c
strings 526 encrypted, keys derived per site
syscalls 36 stubs generated
mba depth variable, seed-driven
rwx pages 0
output apex-win-x64-7a2c4d8e.exe
entropy within bounds
compiled 2.14s 1.2M
The evasion suite
| Capability | Description |
|---|---|
| Indirect Syscalls | 36+ NT APIs resolved at runtime. Hook detection and recovery. |
| Compile-Time String Encryption | All string literals encrypted at build time with per-string derived keys. 526+ instances. Wide string (UTF-16) support. |
| Mixed Boolean-Arithmetic Obfuscation | Constants and arithmetic transformed into algebraically equivalent expressions. Variable depth per call site. Optimizer-resistant. |
| API Hashing | All API resolution via compile-time hashing. No plaintext function names in the binary. |
| RWX-less Code Execution | Code loading paths never create pages with simultaneous write+execute permissions. No VirtualProtect on the primary BOF path. |
| Sleep Encryption | Code sections and heap allocations encrypted during sleep. Metadata self-protected. |
| Spoofed Sleep | Sleep call stack indistinguishable from normal thread synchronization. No timers or callbacks. |
| BOF API Proxying | Sensitive Win32 APIs called from BOFs are intercepted and executed with clean, image-backed call stacks. |
| CET Compatibility | All execution paths produce clean call stacks by architecture, not bolted on with gadgets or frame fabrication. |
| Threadpool Execution | Arbitrary function calls routed through OS thread pool workers for clean stack traces. |
| Anti-Debug | Multiple indirect detection techniques that avoid the most signatured anti-debug APIs. |
| Anti-VM | Hypervisor and timing-based VM detection. |
| Anti-Forensics | Secure self-deletion while running. |
| Environmental Guardrails | Domain, username, hostname, hardware id keying. Temporal keying (activation date, working hours, days). Network keying (CIDR). Kill date. Failure triggers self-destruct. |
| PE Metadata Spoofing | Configurable version info fields. Randomized compilation timestamp. |
| SNI Spoofing | TLS ClientHello hostname independent of actual C2 server. |
| Drip Loading | Page-by-page memory writes with configurable delays. |
| .rdata Entropy Management | Prevents statistical anomalies that automated scanners flag. |
| AMSI Bypass | Architectural. The CLR loading technique avoids the AMSI scanning path entirely. No runtime patching. |
| ETW Evasion | Primary code execution path generates zero NtProtectVirtualMemory EtwTI events. |
Malleable communications profiles
Shape every byte that leaves the agent. ApeX profiles compose request and response payloads from chained transforms: base64, hex, rot13, prepend, append, AES-256-GCM, in any order. SNI, headers, and routes are templated in the same profile file, with a live rendered preview so you can see the wire bytes before you ship.
Why CET compatibility matters
CET-enabled hardware shadow-stacks every return address. Spoofing stacks with synthetic frames or gadget chains trips the shadow stack and triggers a user-mode crash. ApeX produces real image-backed stacks on every execution path, so CET is a feature it works with, not around.
Environmental guardrails
Keying options cover domain, username, hostname, hardware id, time windows, network CIDR, and kill date. Failure trigger: secure self-destruct. The agent does not run outside its box.