文章总结： 该文档介绍了一个基于ClaudeCode的多Agent自动化免杀工程化方案，包含研究、Loader生成、Evasion集成和C2免杀四个Agent，通过知识库管理和技能调用实现自动化生成免杀Loader，涉及API混淆、字符串混淆、内存规避等技术，并提供安装指南、项目架构和核心命令。该方案涉及恶意软件开发，存在法律风险。
综合评分： 10
文章分类： 恶意软件,免杀

被GitHub删了3次的项目：AI驱动的自动化免杀工程化方案

原创

菜狗
菜狗

只会看监控的实习生

2026年9月30日 16:29
广东

在小说阅读器读本章

去阅读

在公众号小说中沉浸阅读

项目概述

环境要求

| 依赖 | 版本要求 | 用途 |
| — | — | — |
| Python | 3.8+ | 知识库管理脚本 |
| MinGW-w64 | 最新版 | 编译 Windows 可执行文件 |
| GitHub CLI (gh) | 2.0+ | 搜索 GitHub 仓库和代码 |
| Claude Code | 最新版 | 主框架 |

安装指南

# 使用 winget 安装
winget install Python.Python.3.12

# 或从官网下载
# https://www.python.org/downloads/

安装 MinGW-w64（交叉编译器）

# 使用 winget 安装
winget install MSYS2.MSYS2

# 安装后，在 MSYS2 终端中运行：
pacman -S mingw-w64-x86_64-gcc

# 添加到 PATH（PowerShell 管理员）
$env:PATH +=&nbsp;";C:\msys64\mingw64\bin"

# 永久添加
[Environment]::SetEnvironmentVariable("PATH",&nbsp;$env:PATH +&nbsp;";C:\msys64\mingw64\bin",&nbsp;"User")

# 验证安装
x86_64-w64-mingw32-gcc --version

安装 GitHub CLI

# 使用 winget 安装
winget install GitHub.cli

# 登录 GitHub
gh auth login

# 验证安装
gh --version
gh auth status

安装 Claude Code

# 使用 npm 安装（需要 Node.js）
npm install -g @anthropic-ai/claude-code

# 或使用官方安装器
# https://github.com/anthropics/claude-code

# 验证安装
claude --version

Linux/macOS 安装

# Ubuntu/Debian
sudo apt update
sudo apt install python3 python3-pip mingw-w64 gh

# macOS（Homebrew）
brew install python mingw-w64 gh

# 安装 Claude Code
npm install -g @anthropic-ai/claude-code

# 登录 GitHub
gh auth login

方法一：项目目录方式（推荐）

# 进入项目目录
cd&nbsp;"D:\Dev\Agent\LoaderSubAgents\LoaderSub Agents"

# 启动 Claude Code
claude

方法二：CLAUDE.md 全局配置

# Windows
notepad %USERPROFILE%\.claude\CLAUDE.md

# Linux/macOS
nano ~/.claude/CLAUDE.md

项目架构

evasion-agent-teams/
├── .claude-plugin/
│ &nbsp; └── plugin.json
├── agents/
│ &nbsp; ├── research-agent.md &nbsp; &nbsp; &nbsp; &nbsp;# 研究技术
│ &nbsp; ├── loadergen-agent.md &nbsp; &nbsp; &nbsp;&nbsp;# 生成 Loader
│ &nbsp; ├── evasion-agent.md &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# 集成 Evasion
│ &nbsp; └── c2-evasion-agent.md &nbsp; &nbsp; &nbsp;# C2 免杀
├── skills/
│ &nbsp; ├── research/
│ &nbsp; │ &nbsp; └── SKILL.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# 搜索分析技能
│ &nbsp; ├── loader_generate/
│ &nbsp; │ &nbsp; └── SKILL.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# Loader 生成技能
│ &nbsp; ├── evasion_integrate/
│ &nbsp; │ &nbsp; └── SKILL.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# Evasion 集成技能
│ &nbsp; └── c2_evasion/
│ &nbsp; &nbsp; &nbsp; └── SKILL.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# C2 免杀技能
├── commands/
│ &nbsp; ├── research.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# /research
│ &nbsp; ├── loader_generate.md &nbsp; &nbsp; &nbsp;&nbsp;# /loader_generate
│ &nbsp; ├── evasion_integrate.md &nbsp; &nbsp;&nbsp;# /evasion_integrate
│ &nbsp; └── c2_evasion.md &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# /c2_evasion
├── lib/
│ &nbsp; └── knowledge_manager.py &nbsp; &nbsp;&nbsp;# 知识库管理脚本
├── knowledge-base/
│ &nbsp; ├── evasion_techniques.json &nbsp;# Evasion 技术库
│ &nbsp; ├── loader_techniques.json &nbsp;&nbsp;# Loader 组件库
│ &nbsp; └── scenarios.json &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# 已生成记录
├── samples/
│ &nbsp; └── calc.bin &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# 测试 Shellcode
├── output/ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# 输出目录
└── README.md

核心命令

/research &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# 交互模式
/research&nbsp;"shellcode loader"&nbsp; &nbsp; &nbsp;# 搜索 Loader
/research&nbsp;"API hashing C++"&nbsp; &nbsp; &nbsp;&nbsp;# 搜索特定技术

Evasion 类型：

Loader 组件库：

{
&nbsp;&nbsp;"component_library": {
&nbsp; &nbsp;&nbsp;"storage_methods": [...],
&nbsp; &nbsp;&nbsp;"memory_allocators": [...],
&nbsp; &nbsp;&nbsp;"data_copiers": [...],
&nbsp; &nbsp;&nbsp;"executors": [...]
&nbsp; }
}

数据流

用户请求
&nbsp; &nbsp; │
&nbsp; &nbsp; ▼
┌─────────────────────────────────────────────────────┐
│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Claude Code 主 Agent &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
└─────────────────────────────────────────────────────┘
&nbsp; &nbsp; │
&nbsp; &nbsp; ├── /research ─────────────────────────────────────┐
&nbsp; &nbsp; │ &nbsp; &nbsp; &nbsp; │ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
&nbsp; &nbsp; │ &nbsp; &nbsp; &nbsp; ▼ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
&nbsp; &nbsp; │ &nbsp; research-agent &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │
&nbsp; &nbsp; │ &nbsp; &nbsp; &nbsp; │ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
&nbsp; &nbsp; │ &nbsp; &nbsp; &nbsp; ▼ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
&nbsp; &nbsp; │ &nbsp; 搜索 GitHub → 分析代码 → 写入知识库 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
&nbsp; &nbsp; │ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │
&nbsp; &nbsp; ├── /loader_generate ──────────────────────────────┤
&nbsp; &nbsp; │ &nbsp; &nbsp; &nbsp; │ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
&nbsp; &nbsp; │ &nbsp; &nbsp; &nbsp; ▼ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
&nbsp; &nbsp; │ &nbsp; loadergen-agent &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
&nbsp; &nbsp; │ &nbsp; &nbsp; &nbsp; │ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
&nbsp; &nbsp; │ &nbsp; &nbsp; &nbsp; ▼ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
&nbsp; &nbsp; │ &nbsp; 查询组件库 → 检查 scenarios → 生成 → 测试 → 记录│
&nbsp; &nbsp; │ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │
&nbsp; &nbsp; └── /evasion_integrate /path/to/loader.c ──────────┤
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ▼ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
&nbsp; &nbsp; &nbsp; &nbsp; evasion-agent &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ▼ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
&nbsp; &nbsp; &nbsp; &nbsp; 读取 Loader → 查询 Evasion 库 → 集成 → 测试 &nbsp; │
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
&nbsp; &nbsp; ┌──────────────────────────────────────────────────┘
&nbsp; &nbsp; │
&nbsp; &nbsp; ▼
┌─────────────────────────────────────┐
│ &nbsp; &nbsp; lib/knowledge_manager.py &nbsp; &nbsp; &nbsp; &nbsp;│
│ &nbsp;- JSON CRUD &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
└─────────────────────────────────────┘
&nbsp; &nbsp; │
&nbsp; &nbsp; ▼
knowledge-base/

快速开始

# 1. 放置测试 Shellcode
# 将 calc.bin 放入 samples/

# 2. 启动 Claude Code
cd&nbsp;"evasion-agent-teams"
claude

# 3. 使用命令
> 搜索 GitHub 上的 shellcode loader 技术
> /loader_generate 5
> /evasion_integrate ./output/loader_001.c --type&nbsp;api_obfuscation

知识库管理

# 查看统计
python lib/knowledge_manager.py stats

# 添加 Evasion 技术
python lib/knowledge_manager.py add-evasion \
&nbsp; --name&nbsp;"API Hashing"&nbsp;\
&nbsp; --type"api_obfuscation"&nbsp;\
&nbsp; --description&nbsp;"通过哈希值动态解析 API"&nbsp;\
&nbsp; --apis&nbsp;"LoadLibrary,GetProcAddress"&nbsp;\
&nbsp; --complexity&nbsp;"medium"

# 添加 Loader 组件
python lib/knowledge_manager.py add-component \
&nbsp; --type"executors"&nbsp;\
&nbsp; --name&nbsp;"ThreadPool Callback"&nbsp;\
&nbsp; --description&nbsp;"使用线程池回调执行"

# 查看组件库
python lib/knowledge_manager.py get-components

# 随机组合
python lib/knowledge_manager.py random-combination

# 导出/导入
python lib/knowledge_manager.py&nbsp;export&nbsp;--output backup.json
python lib/knowledge_manager.py import --input backup.json

安全规则

| Agent &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;| 禁止 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; | 允许 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |
| :----------------- | :----------------------- | :----------------------- |
| `research-agent` &nbsp; | 编译/执行外部代码，使用外部 Shellcode | 分析模式，更新知识库 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |
| `loadergen-agent` &nbsp;| 使用外部代码，使用外部 Shellcode &nbsp; &nbsp;| 仅使用 `samples/calc.bin` &nbsp; |
| `evasion-agent` &nbsp; &nbsp;| 使用外部代码，执行恶意 Shellcode &nbsp; &nbsp;| 仅修改用户代码，仅用 `calc.bin` 测试 |
| `c2-evasion-agent` | 执行恶意操作，破坏性修改 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; | 分析源码，修改规避特征 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|

项目地址

https://github.com/JDArmy/Evasion-SubAgents

低价出售安全证书不限于cisp、pte等cnvd、请Vme～建了一个项目群，想进群的请回复进群即可

免责声明：

本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。

任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。

本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。

本文转载自：只会看监控的实习生菜狗
菜狗《被GitHub删了3次的项目：AI驱动的自动化免杀工程化方案》

Tags: 免杀恶意软件

你可能错过

五角大楼证实发生重大数据泄露，300余万人敏感信息遭访问

专栏｜车联网数字法治与信息安全

九月安全大事件盘点：AI 智能体「抱团越界」，千亿防线遭遇多线告急

当 AI 学会”翻墙”：从 OpenAI 接连暂停训练，聊聊 AI 安全到底在防什么