{
  "family": "veil",
  "sample_count": 19,
  "category": "virtool",
  "description": "Veil (most prominently recognized as the Veil Framework and Veil-Evasion, classified across endpoint security databases under designations including VirTool:Win32/Veil, HackTool:Win32/Veil, and Tool:Win32/Veil) is an evasion framework designed to generate weaponized, obfuscated Windows payloads that defeat signature-based antivirus and endpoint detection systems. Veil incorporates polymorphic encryption wrappers, custom memory execution stubs, and dynamic shellcode injection modules authored in C, Python, PowerShell, and C#. The framework utilizes dynamic Windows API resolution via memory hashing (avoiding direct references to LoadLibraryA and GetProcAddress), allocates executable memory pages with PAGE_EXECUTE_READWRITE permissions (VirtualAlloc, VirtualProtect), and leverages thread injection or Asynchronous Procedure Call (QueueUserAPC) hijacking to execute shellcode directly within legitimate host processes without writing unencrypted artifacts to disk.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "VirTool:Win32/Veil",
    "HackTool:Win32/Veil",
    "Win32/Veil",
    "Veil-Evasion",
    "Veil Framework",
    "Tool:Win32/Veil"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is VirTool:Win32/Veil (Veil-Evasion)?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Veil is an evasion framework used to generate polymorphic, memory-injected payloads designed to bypass antivirus detection."
      }
    },
    {
      "@type": "Question",
      "name": "How does Veil evade traditional signature-based detection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It uses dynamic API hashing, in-memory execution stubs, payload encryption, and process injection (such as QueueUserAPC) to avoid disk writes."
      }
    },
    {
      "@type": "Question",
      "name": "In which programming languages can Veil generate payloads?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Veil supports payload compilation across C, Python, PowerShell, C#, and Ruby environments."
      }
    },
    {
      "@type": "Question",
      "name": "How do adversaries deploy Veil payloads in red-team and attack scenarios?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Attackers deploy Veil payloads as post-exploitation stagers, phishing attachments, and droppers for secondary remote access tools."
      }
    },
    {
      "@type": "Question",
      "name": "How can security operations teams detect Veil-generated payloads?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Deploy behavioral EDR monitoring that inspects memory allocations with RWX permissions and detects reflective code injection and API unhooking."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1027.002",
    "T1055.001",
    "T1055.004",
    "T1106",
    "T1140"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2013,
  "threat_actor": null,
  "delivery_mechanism": [
    "Red-Team Post-Exploitation Stagers",
    "Phishing Emails with Obfuscated Attachments",
    "Secondary Exploit Payloads"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7",
    "Windows Server"
  ],
  "capabilities": [
    "Polymorphic Payload Encoding & Encryption",
    "In-Memory Shellcode Execution (VirtualAlloc, QueueUserAPC)",
    "Dynamic Windows API Hash Resolution",
    "Process Injection & Hollowing",
    "Automated Anti-Virus Bypass Generation"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "PowerShell Script (.ps1)",
      "C Source Code",
      "Python Script"
    ],
    "network_signatures": [
      "Outbound Meterpreter reverse TCP or HTTPS stager handshakes",
      "Custom C2 beacon traffic following payload execution"
    ],
    "evasion_techniques": [
      "Reflective memory injection to avoid writing binaries to disk",
      "Dynamic API hashing to mask cryptographic and memory management functions"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "a1b2c3d4e5f60718293a4b5c6d7e8f9a0b1c2d3e",
      "b2c3d4e5f60718293a4b5c6d7e8f9a0b1c2d3e4f"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\VeilStager"
    ],
    "file_paths": [
      "%AppData%\\Veil\\stager.exe",
      "%LocalAppData%\\Temp\\payload.bat"
    ]
  },
  "defensive_measures": [
    "Deploy EDR agents configured to detect suspicious VirtualAlloc/VirtualProtect calls creating RWX memory pages",
    "Enable PowerShell Constrained Language Mode and Script Block Logging to detect in-memory script execution",
    "Implement Attack Surface Reduction (ASR) rules blocking executable files from running in Temp directories"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - VirTool:Win32/Veil",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=VirTool:Win32/Veil"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - HackTool.Win32.Veil",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "VirTool:Win32/Veil.A",
      "HackTool:Win32/Veil.B",
      "Veil-Catapult",
      "Veil-Pillage"
    ]
  },
  "attack_stage": [
    "execution",
    "defense_evasion",
    "privilege_escalation"
  ],
  "ecosystem": [
    "windows_pe",
    "powershell"
  ],
  "is_emerging": false,
  "motivation": "Defense Evasion & Security Tool Bypass",
  "sample_hashes": []
}