T4y1oR/RingQ

Health v2 · maintenance only

Flags: no_releases no_license

Adoption not part of the score

1497 stars · 149 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

RingQ is a post-exploitation antivirus evasion tool that obfuscates and loads arbitrary Windows executables or shellcode (e.g., Cobalt Strike, fscan, mimikatz) to bypass AV/EDR products like 360, Huorong, and Windows Defender. It generates an obfuscated payload file with Create.exe and loads it on the target machine with anti-sandbox techniques built in.

Use cases

• bypass windows defender to run mimikatz
• evade 360 and huorong antivirus detection
• load cobalt strike shellcode without getting flagged
• convert exe tools to obfuscated shellcode loaders
• run pentest tools on av-protected windows machines
• anti-sandbox shellcode execution

When to choose

• you need quick AV/EDR evasion for post-exploitation tooling on Windows
• you want a simple obfuscate-and-load workflow without writing your own loader
• you need to bypass 360 QVM, Huorong, or Defender heuristics

When to avoid

• you need a maintained, licensed security product for production use
• your use case is defensive security or malware analysis rather than offensive testing
• you require cross-platform support beyond Windows

Facets

cli-tool · maturity active

security cryptography reverse-engineering security penetration-testing windows windows cpp antivirus-evasion shellcode-loader post-exploitation red-team malware-obfuscation bypass-av-edr

Member repositories

For agents

markdown · JSON · MCP: product_card(name="T4y1oR/RingQ")