Alternatives and similar repositories for MalwareInvestigation

Users that are interested in MalwareInvestigation are comparing it to the libraries listed below

• cod3nym / Deobfuscar
  A simple commandline application to automatically decrypt strings from Obfuscator protected binaries
  ☆47Updated last year
• cbrnrd / maliketh
  🗡️ A multi-user malleable C2 framework targeting Windows. Written in C++ and Python
  ☆45Updated this week
• C5Hackr / Segment-Encryption
  ☆28Updated last year
• Idov31 / NidhoggCSharpApi
  C# API for Nidhogg rootkit
  ☆20Updated last year
• aaaddress1 / ntkrnlProtectScan
  One Click Tool to Scan All the Enabled Protection of current Windows NT Kernel
  ☆43Updated 2 years ago
• EvilBytecode / Evilbytecode-Gate
  Evilbytecode-Gate resolves Windows System Service Numbers (SSNs) using two methods: analyzing the Guard CF Table in ntdll.dll and parsing…
  ☆26Updated 9 months ago
• Crowdfense / CVE-2024-21338
  Windows AppLocker Driver (appid.sys) LPE
  ☆73Updated last year
• lleon1435 / Kernel_VADInjector
  Windows 10 DLL Injector via Driver utilizing VAD and hiding the loaded driver
  ☆53Updated 2 years ago
• SaadAhla / HadesLdr
  Shellcode Loader Implementing Indirect Dynamic Syscall , API Hashing, Fileless Shellcode retrieving using Winsock2
  ☆13Updated 2 years ago
• ahkeur / VEH2
  A Patchless AMSI Bypass Technique using VEH²
  ☆30Updated 7 months ago
• EvilBytecode / TaskMgr-Troll
  Troll TaskManager, and play with it .
  ☆30Updated 6 months ago
• S12cybersecurity / NinjaInjector
  Classic Process Injection with Memory Evasion Techniques implemantation
  ☆72Updated 2 years ago
• C5Hackr / c_syscalls
  https://github.com/janoglezcampos/c_syscalls with the ASM rewritten by myself for Visual Studio's Compiler.
  ☆33Updated last year
• hwbp / LazyHook
  Evade behavioral analysis by executing malicious code within trusted Microsoft call stacks, patchless hooking library IAT/EAT.
  ☆129Updated 2 months ago
• EvilBytecode / Amsi-Patch-Updated-2025
  How to bypass AMSI (Antimalware Scan Interface) in PowerShell/C++ by dynamically patching the AmsiScanBuffer function.
  ☆25Updated 9 months ago
• hasherezade / shellc_encoder
  Standalone Metasploit-like XOR encoder for shellcode
  ☆50Updated last year
• C5Hackr / Eclipse
  A unique introduction to native runtime obfuscation.
  ☆74Updated 11 months ago
• iDigitalFlame / XrMT
  e(X)tensiable (Rust) Malware Toolkit: (Soon!) Full Featured Rust C2 Framework with Awesome Features!
  ☆27Updated last year
• Dump-GUY / sc2pe
  Simple dotnet Native AOT app that uses AsmResolver to convert shellcode to PE
  ☆66Updated 2 years ago
• AlSch092 / HideStaticReferences
  Research into removing strings & API call references at compile-time (Anti-Analysis)
  ☆28Updated last year
• EvilBytecode / SsnRetrieval
  Loads NTDLL, parses the PE file, extracts "Zw" functions, retrieves their System Service Numbers (SSNs), and prints each function’s name,…
  ☆15Updated 9 months ago
• qwqdanchun / RainbowSheep
  Change hash for a signed pe
  ☆17Updated 2 years ago
• fin3ss3g0d / HookFinder
  Simple PoC to locate hooked functions by EDR in ntdll.dll
  ☆46Updated 2 years ago
• frkngksl / UnlinkDLL
  DLL Unlinking from InLoadOrderModuleList, InMemoryOrderModuleList, InInitializationOrderModuleList, and LdrpHashTable
  ☆58Updated 2 years ago
• susMdT / SharpIndirectSyscalls
  ☆11Updated 2 years ago
• rad9800 / BloatedHammer
  API Hammering with C++20
  ☆50Updated 3 years ago
• NUL0x4C / GP
  using the gpu to hide your payload
  ☆63Updated 3 years ago
• shaddy43 / AES_Shellcode_Encryptor
  This repository contains a tool that can encrypt all type of files and give the encrypted output in the form of an encrypted shellcode. P…
  ☆16Updated 4 years ago
• JayGLXR / MacOS-Stealer-in-Rust
  MacOS Stealer written in Rust. For Legal and Ethical Research Purposes Only.
  ☆26Updated last year
• backdoorskid / ClrAmsiScanPatcher
  Patches the AmsiScan function in clr.dll allowing for unrestricted assembly loading in .NET
  ☆50Updated 9 months ago