My adventures in learning about different userland malware techniques, such as syscalls, injection, unhooking or sandbox evasion.
☆80Jan 10, 2024Updated 2 years ago
Alternatives and similar repositories for MalwareAdventurez
Users that are interested in MalwareAdventurez are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- WinXPSP2.Cermalus on stereoids, supporting all 32 bits Windows version. Windows Kernel Virus stuff for noobs☆18Aug 11, 2023Updated 3 years ago
- Red-Teaming TempleOS.☆17Jul 29, 2022Updated 4 years ago
- The GTK Keylogger☆17Aug 11, 2023Updated 3 years ago
- A C++/Asm template for PIC/EXE/DLL malware☆24Aug 12, 2025Updated last year
- Learn Winapi in this Repo with examples, to understand its abstraction in reverse engineering for Windows.☆11Aug 8, 2022Updated 4 years ago
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- yet another sleep encryption thing. also used the default github repo name for this one.☆67May 11, 2023Updated 3 years ago
- Experimental Windows x64 Kernel Rootkit with anti-rootkit evasion features.☆610Aug 2, 2025Updated last year
- ☆46Jan 1, 2023Updated 3 years ago
- vs2019 环境 Gh0st编译通过☆14Nov 28, 2021Updated 4 years ago
- Performing Indirect Clean Syscalls☆631May 2, 2026Updated 5 months ago
- ☆16Sep 23, 2021Updated 5 years ago
- malleable profile generator GUI for Havoc☆55Apr 28, 2023Updated 3 years ago
- Trolling Keyloggers by Forcing them to log Specific Text then freezing them☆21Jul 30, 2022Updated 4 years ago
- NTDLL unhooking via Parun's Fart technique to bypass EDR userland hooks☆76Feb 15, 2023Updated 3 years ago
- Wordpress hosting with auto-scaling - Free Trial Offer • AdFully Managed hosting for WordPress and WooCommerce businesses that need reliable, auto-scalable performance. Cloudways SafeUpdates now available.
- Bypassing UAC with SSPI Datagram Contexts☆473Sep 24, 2023Updated 3 years ago
- A CobaltStrike toolkit to write files produced by Beacon to memory instead of disk☆474Jul 6, 2024Updated 2 years ago
- A small Aggressor script to help Red Teams identify foreign processes on a host machine☆89Jan 6, 2023Updated 3 years ago
- ☆10Sep 11, 2026Updated last month
- Interceptor is a kernel driver focused on tampering with EDR/AV solutions in kernel space☆134Jan 2, 2023Updated 3 years ago
- random code snippets, useful for getting started☆125Nov 29, 2025Updated 10 months ago
- ☆91Jun 2, 2024Updated 2 years ago
- miscellaneous scripts and programs☆291May 13, 2026Updated 5 months ago
- My collection of malware dev links☆327Feb 9, 2026Updated 8 months ago
- Simple, predictable pricing with DigitalOcean hosting • AdAlways know what you'll pay with monthly caps and flat pricing. Enterprise-grade infrastructure trusted by 600k+ customers.
- 🗡️ A multi-user malleable C2 framework targeting Windows. Written in C++ and Python☆45Feb 6, 2026Updated 8 months ago
- different ntdll unhooking techniques : unhooking ntdll from disk, from KnownDlls, from suspended process, from remote server (fileless)☆202Aug 2, 2023Updated 3 years ago
- Reflective DLL Injection with obfuscated (XOR) shellcode☆72Dec 13, 2020Updated 5 years ago
- Shellcode Loader Implementing Indirect Dynamic Syscall , API Hashing, Fileless Shellcode retrieving using Winsock2☆298Jul 15, 2023Updated 3 years ago
- Shellcode Loader with Indirect Dynamic syscall Implementation , shellcode in MAC format, API resolving from PEB, Syscall calll and syscal…☆321Aug 2, 2023Updated 3 years ago
- Find DLLs with RWX section☆81Jul 3, 2023Updated 3 years ago
- .NET assembly loader with patchless AMSI and ETW bypass☆392Apr 19, 2023Updated 3 years ago
- Artemis - C++ Hell's Gate Syscall Implementation☆35Aug 16, 2023Updated 3 years ago
- Simple PoC to locate hooked functions by EDR in ntdll.dll☆45Jul 16, 2023Updated 3 years ago
- GPU virtual machines on DigitalOcean Gradient AI • AdGet to production fast with high-performance AMD and NVIDIA GPUs you can spin up in seconds. The definition of operational simplicity.
- Extracting NetNTLM without touching lsass.exe☆244Nov 27, 2023Updated 2 years ago
- Start with shellcode execution using Windows APIs (high level), move on to native APIs (medium level) and finally to direct syscalls (low…☆148May 6, 2023Updated 3 years ago
- My implementation of the GIUDA project in C++☆189Jul 25, 2023Updated 3 years ago
- Run Cobalt Strike BOFs in Brute Ratel C4!☆91Apr 15, 2025Updated last year
- 💻 Windows 10 Kernel-mode rootkit☆30Sep 3, 2022Updated 4 years ago
- WindowSpy is a Cobalt Strike Beacon Object File meant for automated and targeted user surveillance.☆284Feb 24, 2025Updated last year
- Dump LSASS by spoofing command line arguments to procdump.☆19Oct 21, 2024Updated last year