AdvDebug / BehavEye
Advanced dynamic malware analysis tool.
☆69Updated 9 months ago
Related projects ⓘ
Alternatives and complementary repositories for BehavEye
- Unpacker and Config Extractor for managed Redline Stealer payloads☆39Updated last year
- user-mode Rootkit☆98Updated 2 years ago
- Rust malware EDR evasion via direct syscalls, fully implemented as an example in Rust☆19Updated 5 months ago
- A stealthy, assembly-based tool for secure function address resolution, offering a robust alternative to GetProcAddress.☆70Updated 8 months ago
- Deleting Shadow Copies In Pure C++☆113Updated 2 years ago
- A collection of small scripts and tools for deobfuscation and malware analysis.☆65Updated last year
- This is the combination of multiple evasion techniques to evade defenses. (Dirty Vanity)☆46Updated 6 months ago
- a small wiper malware programmed in c#☆45Updated 2 years ago
- Simple ransomware written in Rust. Part of the building a rustomware blog post.☆32Updated last year
- A feed of malware samples curated from threat intelligence sources.☆24Updated last year
- A attempt at replicating BLACKLOTUS capabilities, whilst not acting as a direct mimic.☆85Updated last year
- This project is an implant framework designed for long term persistent access to Windows machines.☆110Updated last year
- Powershell implementation of a novel technique. Invoke-GPTObfuscation is a PowerShell Obfuscator that utilizes OpenAI (and other APIs) to…☆49Updated 11 months ago
- A collection of source code, binaries, and compilation scripts designed to bypass detection☆25Updated last year
- Lime Crypter Obfuscator Mod☆25Updated 4 months ago
- A command and control framework.☆35Updated 3 months ago
- ☆24Updated 6 months ago
- A privilege escalation vulnerability exists in Windows due to a flaw in the implementation of the Atom Table. An attacker could exploit t…☆26Updated 2 months ago
- Dirty PoC on how to abuse S1's VEH for Vectored Syscalls and Local Execution☆38Updated 4 months ago
- Nim process hollowing loader☆47Updated 3 months ago
- Simple dotnet Native AOT app that uses AsmResolver to convert shellcode to PE☆64Updated last year
- a stage1 DLL loader with sleep obfuscation☆32Updated last year
- This is way to load a shellcode, and obfuscate it, so it avoids scantime detection.☆51Updated 4 months ago
- A simple go Proof of Concept to start a new shell as TrustedInstaller☆47Updated last year
- Collection of one-liners to bypass User Account Control (UAC) in Windows. These techniques exploit certain behavior in Windows applicatio…☆85Updated last year
- Scan your computer for known vulnerable and known malicious Windows drivers using loldrivers.io☆79Updated 9 months ago
- DLL Unlinking from InLoadOrderModuleList, InMemoryOrderModuleList, InInitializationOrderModuleList, and LdrpHashTable☆57Updated 11 months ago