Alternatives and similar repositories for MalwareInvestigation:

Users that are interested in MalwareInvestigation are comparing it to the libraries listed below

• EvilBytecode / Nyx-Full-Dll-Unhook
  (EDR) Dll Unhooking = kernel32.dll, kernelbase.dll, ntdll.dll, user32.dll, apphelp.dll, msvcrt.dll.
  ☆19Updated 8 months ago
• EvilBytecode / SsnRetrieval
  Loads NTDLL, parses the PE file, extracts "Zw" functions, retrieves their System Service Numbers (SSNs), and prints each function’s name,…
  ☆11Updated 7 months ago
• AlSch092 / HideStaticReferences
  Research into removing strings & API call references at compile-time (Anti-Analysis)
  ☆25Updated 9 months ago
• Idov31 / NidhoggCSharpApi
  C# API for Nidhogg rootkit
  ☆17Updated 11 months ago
• aaaddress1 / ntkrnlProtectScan
  One Click Tool to Scan All the Enabled Protection of current Windows NT Kernel
  ☆43Updated last year
• C5Hackr / c_syscalls
  https://github.com/janoglezcampos/c_syscalls with the ASM rewritten by myself for Visual Studio's Compiler.
  ☆30Updated 9 months ago
• qwqdanchun / RainbowSheep
  Change hash for a signed pe
  ☆16Updated last year
• EvilBytecode / Evilbytecode-Anti-VM
  Measures average CPU cycles for the CPUID instruction to detect if the code is running in a VM by comparing against a threshold.
  ☆20Updated 7 months ago
• EvilBytecode / GoEvilDocs
  Malware development in Go, learn today, anti dynamic analysis & Static & sandboxes.
  ☆11Updated 9 months ago
• EvilBytecode / ThunderKitty-Ransomware
  Ransomware written in go, encrypt - decrypt.
  ☆18Updated 9 months ago
• EvilBytecode / Evilbytecode-Gate
  Evilbytecode-Gate resolves Windows System Service Numbers (SSNs) using two methods: analyzing the Guard CF Table in ntdll.dll and parsing…
  ☆20Updated last month
• Offensive-Panda / D3MPSEC
  "D3MPSEC" is a memory dumping tool designed to extract memory dump from Lsass process using various techniques, including direct system c…
  ☆24Updated 6 months ago
• EvilBytecode / PPID-Spoofing
  Parent Process ID Spoofing, coded in CGo.
  ☆22Updated 9 months ago
• reveng007 / reveng_loader
  C# loader capable of running stage-1 from remote url, file path as well as file share
  ☆17Updated 2 years ago
• knight0x07 / NailaoLoader-Hiding-Execution-Flow
  NailaoLoader: Hiding Execution Flow via Patching
  ☆19Updated last month
• susMdT / SharpIndirectSyscalls
  ☆11Updated 2 years ago
• EvilBytecode / Ntdll-Unhook
  Unhook Ntdll.dll, Go & C++.
  ☆21Updated 8 months ago
• Kharos102 / ReadWriteDriverSample
  ☆21Updated 11 months ago
• sergiLopez / Flanders-Trojan
  Trojan written in C++ for Windows
  ☆15Updated last year
• Cracked5pider / kaine-assembly
  a demo module for the kaine agent to execute and inject assembly modules
  ☆38Updated 7 months ago
• keowu / InstrumentationCallbackToolKit
  A fast method to intercept syscalls from any user-mode process using InstrumentationCallback and detect any process using Instrumentation…
  ☆26Updated last year
• rbmm / RtlClone
  ☆37Updated last month
• GetRektBoy724 / SyscallShuffler
  Your NTDLL vaccine from modern direct syscall methods.
  ☆35Updated 2 years ago
• shaddy43 / AES_Shellcode_Encryptor
  This repository contains a tool that can encrypt all type of files and give the encrypted output in the form of an encrypted shellcode. P…
  ☆15Updated 3 years ago
• GetRektBoy724 / SharpLoadLibrary
  An attempt to make a LoadLibrary designed for offensive operations, in C# obviously.
  ☆55Updated 3 years ago
• AlSch092 / ModifyExports
  Research of modifying exported function names at runtime (C/C++, Windows)
  ☆17Updated 10 months ago
• EvilBytecode / EByte-Shellcode-Loader
  shellcode loader that uses indirect syscalls written in D Lang The loader bypasses user-mode hooks by resolving system calls manually fro…
  ☆9Updated 6 months ago
• Uri3n / Advanced-TLS-Injection
  Threadless injection via TLS callbacks
  ☆16Updated 4 months ago
• hasherezade / shellc_encoder
  Standalone Metasploit-like XOR encoder for shellcode
  ☆47Updated 10 months ago
• OtterHacker / CoffLoader
  ☆52Updated 2 years ago