cocomelonc / 2022-06-05-malware-av-evasion-7

Related projects: ⓘ

• cocomelonc / offzone-2024-malware-persistence-workshop
  OFFZONE 2024 Malware Persistence workshop
  ☆14Updated 3 weeks ago
• cocomelonc / 2022-07-21-malware-tricks-22
  Run payload like a Lazarus Group (UuidFromStringA). C++ implementation
  ☆17Updated 2 years ago
• knight0x07 / BumbleCrypt
  A Bumblebee-inspired Crypter
  ☆79Updated last year
• vatsalgupta67 / Process-Hollowing
  Red Team Operation's Defense Evasion Technique.
  ☆50Updated 3 months ago
• xalicex / Get-DLL-and-Function-Addresses
  GetModuleHandle (via PEB) and GetProcAddress (via EAT) like
  ☆31Updated 2 years ago
• NtQuerySystemInformation / NlsCodeInjectionThroughRegistry
  Dll injection through code page id modification in registry. Based on jonas lykk research
  ☆116Updated last year
• rad9800 / BloatedHammer
  API Hammering with C++20
  ☆34Updated 2 years ago
• APT64 / KernelAVKiller
  Antivirus killer using ring-0 kernel driver. Antivirus processes will automatically close while the killer is running.
  ☆6Updated last year
• AlSch092 / HideStaticReferences
  Research into removing strings & API call references at compile-time (Anti-Analysis)
  ☆22Updated 3 months ago
• mrexodia / lolbin-poc
  Small PoC of using a Microsoft signed executable as a lolbin.
  ☆131Updated last year
• connormcgarr / Kernel-Escalation-of-Privileges-Payloads
  NT AUTHORITY\SYSTEM
  ☆37Updated 4 years ago
• PL-V / Firefox-Grabber
  Grab Firefox post requests by hooking PR_Write function from nss3.dll module using trampoline hook to get passwords and emails of users
  ☆42Updated last year
• XaFF-XaFF / ZwProcessHollowing
  ZwProcessHollowing is a x64 process hollowing project which uses direct systemcalls, dll unhooking and RC4 payload decryption
  ☆79Updated last year
• XaFF-XaFF / Shellcodev
  Shellcodev is a tool designed to help and automate the process of shellcode creation.
  ☆100Updated 11 months ago
• ZeroMemoryEx / SleepKiller
  Bypass Malware Time Delays
  ☆96Updated last year
• BlackHat-Ashura / Process_Ghosting
  Process Ghosting is a technique in which a process is created from a delete pending file. This means the created process is not backed by…
  ☆14Updated 4 months ago
• xalicex / Unhook-Import-Address-Table
  Piece of code to detect and remove hooks in IAT
  ☆51Updated 2 years ago
• AzAgarampur / PsForge
  Process Hollowing demonstration & explanation
  ☆31Updated 3 years ago
• ORCA666 / KCTHIJACK
  ☆43Updated this week
• realoriginal / bootdoor
  An initial proof of concept of a bootkit based on Cr4sh's DMABackdoorBoot
  ☆56Updated last year
• fcccode / Vx-Engines
  Collection of source code for Polymorphic, Metamorphic, and Permutation Engines used in Malware
  ☆23Updated 4 years ago
• GetRektBoy724 / SyscallShuffler
  Your NTDLL vaccine from modern direct syscall methods.
  ☆35Updated 2 years ago
• yoavshah / ImportlessApi
  ☆18Updated 9 months ago
• AzAgarampur / byeintegrity9-uac
  ☆35Updated last year
• SaadAhla / BlockNonMSModules
  Set the process mitigation policy for loading only Microsoft Modules , and block any userland 3rd party modules
  ☆41Updated last year
• Reijaff / offensive_c
  ☆41Updated last year
• trickster0 / CReadMemory
  Read Memory without ReadProcessMemory for Current Process
  ☆73Updated 2 years ago
• ZeroMemoryEx / Overlord
  abusing Process Hacker driver to terminate other processes (BYOVD)
  ☆81Updated last year
• elddy / Windows-NTAPI-Injector
  Inject shellcode to process using Windows NTAPI for bypassing EDRs and Antiviruses
  ☆40Updated 3 years ago
• b4rth0v5k1 / EarlyBirdNTDLL
  ☆33Updated last year