Alternatives and similar repositories for NoMoreStealers

Users that are interested in NoMoreStealers are comparing it to the libraries listed below

• xaitax / NTSleuth
  Comprehensive Windows Syscall Extraction & Analysis Framework
  ☆160Updated 5 months ago
• HullaBrian / COMmander
  .NET tool used to enrich RPC telemetry
  ☆101Updated last week
• r0keb / TrashFormer
  A 64 bit executable junk code engine for polymorphic malware.
  ☆75Updated 7 months ago
• TwoSevenOneT / EDRStartupHinder
  EDRStartupHinder: A red team tool to prevent Antivirus and EDR from running.
  ☆180Updated 3 weeks ago
• EvilBytecode / EvilByte-Remote-AMSI-Bypass
  Bypasses AMSI protection through remote memory patching and parsing technique.
  ☆54Updated 8 months ago
• OtterHacker / Hooker
  ☆108Updated last year
• olafhartong / ETWLocksmith
  A powerful Windows command-line tool for analyzing and searching ETW (Event Tracing for Windows) provider permissions from the Windows re…
  ☆62Updated 6 months ago
• EvilBytecode / Ebyte-Syscalls
  Obfuscating function calls using Vectored Exception Handlers by redirecting execution through exception-based control flow. Uses byte swa…
  ☆112Updated 3 months ago
• ioncodes / SilentLoad
  "Service-less" driver loading
  ☆166Updated last year
• dis0rder0x00 / obex
  Obex – Blocking unwanted DLLs in user mode
  ☆280Updated 4 months ago
• Workday / raw-disk-parser
  A tool to interact with Windows drivers to perform a raw disk read and parse out target files without calling standard Windows file APIs
  ☆105Updated 5 months ago
• hwbp / LazyHook
  Evade behavioral analysis by executing malicious code within trusted Microsoft call stacks, patchless hooking library IAT/EAT.
  ☆129Updated last month
• WKL-Sec / FuncAddressPro
  A stealthy, assembly-based tool for secure function address resolution, offering a robust alternative to GetProcAddress.
  ☆72Updated last year
• warpnet / COM-Fuzzer
  Gain insights into COM/DCOM implementations that may be vulnerable using an automated approach and make it easy to visualize the data. By…
  ☆154Updated 2 months ago
• voidvxvi / HellBunny
  Malleable shellcode loader written in C and Assembly utilizing direct or indirect syscalls for evading EDR hooks
  ☆136Updated last year
• yo-yo-yo-jbo / commandline_spoofing
  Commandline spoofing on Windows
  ☆92Updated 2 months ago
• EvilBytecode / Detecting-Indirect-Syscalls
  Detection of indirect syscall techniques using hardware breakpoints and vectored exception handling.
  ☆51Updated 3 months ago
• Print3M / epic
  PIC shellcode (C/C++) development toolkit designed for malware developers.
  ☆119Updated last month
• sensepost / pipetap
  A Windows Named Pipe Multi-tool / Proxy
  ☆283Updated last month
• electroglyph / anti_defender
  A slightly more fun way to disable windows defender
  ☆52Updated 9 months ago
• SaadAhla / Anti-Sandbox
  ☆49Updated 2 months ago
• andreisss / Remote-DLL-Injection-with-Timer-based-Shellcode-Execution
  Remote DLL Injection with Timer-based Shellcode Execution
  ☆152Updated 6 months ago
• 0xTriboulet / T-1
  T-1 is a shellcode loader that leverages ML techniques to detect VM environments
  ☆34Updated last year
• mez-0 / citadel
  A Payload Analysis Framework
  ☆114Updated 3 months ago
• C5Hackr / Eclipse
  A unique introduction to native runtime obfuscation.
  ☆74Updated 11 months ago
• brosck / L1LKiller
  「⚠️」Performing a BYOVD on the truesight.sys driver
  ☆44Updated last year
• whokilleddb / function-collections
  A collection of PoCs to do common things in unconventional ways
  ☆122Updated 5 months ago
• furax124 / Protect_Loader
  A fucking real shellcode loader with a GUI. Work-in-Progress.
  ☆81Updated 7 months ago
• EvilBytecode / TaskMgr-Troll
  Troll TaskManager, and play with it .
  ☆30Updated 6 months ago
• Faran-17 / Hellshazzard
  Indirect Syscall implementation to bypass userland NTAPIs hooking.
  ☆83Updated last year