SaadAhla/FilelessPELoader

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

1037 stars · 195 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A C++ tool that fetches an AES-encrypted Windows PE executable from a remote location, decrypts it in memory, and executes it without writing to disk (fileless loading). It is aimed at red team and penetration testing scenarios.

Use cases

• load a remote encrypted payload entirely in memory
• run PE executables without touching disk during pentests
• test EDR detection of fileless execution techniques
• deliver AES-encrypted red team tooling
• study in-memory PE loading and decryption techniques
• simulate malware-like execution for blue team training

When to choose

• you need fileless in-memory execution of Windows PE payloads
• you want payloads encrypted at rest with AES and fetched remotely
• you are doing authorized red team or penetration testing work
• you want a simple open-source reference for PE memory loading

When to avoid

• you need a full-featured C2 framework with post-exploitation capabilities
• you require cross-platform support beyond Windows
• you want a maintained tool with active development and recent updates
• you need stealth features like AMSI or ETW bypass

Facets

cli-tool · maturity maintenance

security cryptography developer-tools security penetration-testing windows cpp cli red-team fileless-execution pe-loader aes-encryption offensive-security malware-development pentesting

Member repositories

For agents

markdown · JSON · MCP: product_card(name="SaadAhla/FilelessPELoader")