captain-woof / malware-studyLinks
My projects to understand malware development and detection. Use responsibly. I'm not responsible if you cause unauthorised damage to anyone's system.
☆70Updated last month
Alternatives and similar repositories for malware-study
Users that are interested in malware-study are comparing it to the libraries listed below
Sorting:
- Shellcode loader using direct syscalls via Hell's Gate and payload encryption.☆89Updated 11 months ago
- Construct the payload at runtime using an array of offsets☆63Updated 11 months ago
- Injecting DLL into LSASS at boot☆113Updated last month
- A Powershell AMSI Bypass technique via Vectored Exception Handler (VEH). This technique does not perform assembly instruction patching, f…☆161Updated last year
- Indirect Syscall implementation to bypass userland NTAPIs hooking.☆73Updated 9 months ago
- ☆155Updated 5 months ago
- Do some DLL SideLoading magic☆83Updated last year
- Impersonate Tokens using only NTAPI functions☆73Updated 2 months ago
- Shellcode loader☆81Updated 6 months ago
- ☆111Updated 4 months ago
- Stealthier variation of Module Stomping and Module Overloading injection techniques that reduces memory IoCs. Implemented in Python ctype…☆116Updated last year
- Zero EAT touch way to retrieve function addresses (GetProcAddress on steroids)☆141Updated last year
- Template-based generation of shellcode loaders☆77Updated last year
- NidhoggScript is a tool to generate "script" file that allows execution of multiple commands for Nidhogg☆46Updated last year
- Stage 0☆160Updated 5 months ago
- ☆125Updated 9 months ago
- reflectively load and execute PEs locally and remotely bypassing EDR hooks☆153Updated last year
- ☆151Updated last year
- BOF that finds all the Nt* system call stubs within NTDLL and overwrites with clean syscall stubs (user land hook evasion)☆183Updated 4 months ago
- ☆141Updated 7 months ago
- This project is an implant framework designed for long term persistent access to Windows machines.☆110Updated last year
- ☆164Updated 10 months ago
- DebugAmsi is another way to bypass AMSI through the Windows process debugger mechanism.☆97Updated last year
- Simple POC library to execute arbitrary calls proxying them via NdrServerCall2 or similar☆130Updated 9 months ago
- ☆115Updated 2 months ago
- An x64 position-independent shellcode stager that verifies the stage it retrieves prior to execution☆187Updated 6 months ago
- A BOF to enumerate system process, their protection levels, and more.☆116Updated 6 months ago
- A variation of ProcessOverwriting to execute shellcode on an executable's section☆148Updated last year
- Malware?☆70Updated 7 months ago
- ☆107Updated 4 months ago