PACHAKUTlQ / ThreatCheck
A malware-analysis tool that identify the exact position and details of malicious content in binary files using external Anti-Virus scanners. Supports all AV scanners.
☆22Updated last year
Alternatives and similar repositories for ThreatCheck:
Users that are interested in ThreatCheck are comparing it to the libraries listed below
- Shellcode loader using direct syscalls via Hell's Gate and payload encryption.☆85Updated 8 months ago
- Template-based generation of shellcode loaders☆73Updated 10 months ago
- Loading Fileless Remote PE from URI to memory with argument passing and ETW patching and NTDLL unhooking and No New Thread technique☆62Updated 2 years ago
- Create Anti-Copy DRM Malware☆52Updated 6 months ago
- A simple Sleepmask BOF example☆86Updated 5 months ago
- Huffman Coding in Shellcode Obfuscation & Dynamic Indirect Syscalls Loader.☆90Updated 11 months ago
- CobaltStrike BOF to spawn Beacons using DLL Application Directory Hijacking☆224Updated last year
- ☆122Updated 5 months ago
- A nice process dumping tool☆78Updated 2 years ago
- Threadless shellcode injection tool☆63Updated 6 months ago
- ApexLdr is a DLL Payload Loader written in C☆109Updated 7 months ago
- Implementing the ghostly hollowing PE injection technique using tampered syscalls.☆131Updated 8 months ago
- Just another C2 Redirector using CloudFlare.☆86Updated 9 months ago
- reflectively load and execute PEs locally and remotely bypassing EDR hooks☆147Updated last year
- Improved version of EKKO by @5pider that Encrypts only Image Sections☆118Updated 2 years ago
- Simple POC library to execute arbitrary calls proxying them via NdrServerCall2 or similar☆125Updated 6 months ago
- TypeLib persistence technique☆107Updated 3 months ago
- ☆120Updated last year
- This script is used to bypass DLL Hooking using a fresh mapped copy of ntdll file, patch the ETW and trigger a shellcode with process hol…☆68Updated last year
- Execute shellcode files with rundll32☆190Updated last year
- ☆75Updated last year
- Generic PE loader for fast prototyping evasion techniques☆213Updated 7 months ago
- A 64-bit, position-independent code reverse TCP shell for Windows — built in Rust.☆54Updated last month
- DebugAmsi is another way to bypass AMSI through the Windows process debugger mechanism.☆96Updated last year
- ☆36Updated 2 years ago
- Stealthier variation of Module Stomping and Module Overloading injection techniques that reduces memory IoCs. Implemented in Python ctype…☆110Updated last year
- Explorer Persistence technique : Hijacking cscapi.dll order loading path and writing our malicious dll into C:\Windows\cscapi.dll , when …☆81Updated 2 years ago
- ☆107Updated 3 months ago
- Do some DLL SideLoading magic☆78Updated last year
- Splitting and executing shellcode across multiple pages☆99Updated last year