f0wl / MalwareLab_VM-Setup
Setup scripts for my Malware Analysis VMs
☆245Updated 2 years ago
Related projects ⓘ
Alternatives and complementary repositories for MalwareLab_VM-Setup
- Anti-virus artifacts. Listing APIs hooked by: Avira, BitDefender, F-Secure, MalwareBytes, Norton, TrendMicro, and WebRoot.☆724Updated 3 years ago
- ☆1,024Updated 11 months ago
- Scan files or process memory for CobaltStrike beacons and parse their configuration☆900Updated 3 years ago
- Code and yara rules to detect and analyze Cobalt Strike☆264Updated 3 years ago
- ☆729Updated last year
- Exercise writeups from the book Practical Malware Analysis.☆198Updated last year
- Tool based on CobaltStrikeParser from SentinelOne which can be used to spam a CobaltStrike server with fake beacons☆367Updated 3 years ago
- A repository that maps commonly used attacks using MSRPC protocols to ATT&CK☆313Updated last year
- Hunts out CobaltStrike beacons and logs operator command output☆888Updated 2 months ago
- ☆192Updated last month
- Scan installed EDRs and AVs on Windows☆569Updated last year
- Extract and Deobfuscate XLM macros (a.k.a Excel 4.0 Macros)☆573Updated 6 months ago
- Skrull is a malware DRM, that prevents Automatic Sample Submission by AV/EDR and Signature Scanning from Kernel. It generates launchers t…☆448Updated 3 years ago
- ☆290Updated 3 years ago
- Quickly debug shellcode extracted during malware analysis☆565Updated last year
- Analysis of malware and Cyber Threat Intel of APT and cybercriminals groups☆704Updated last year
- Detect and respond to Cobalt Strike beacons using ETW.☆481Updated 2 years ago
- Emulate and Dissect MSF and *other* attacks☆139Updated 8 months ago
- POCs for Shellcode Injection via Callbacks☆393Updated 3 years ago
- Evasions encyclopedia gathers methods used by malware to evade detection when run in virtualized environment. Methods are grouped into ca…☆386Updated 4 months ago
- Expriments☆445Updated last month
- Standard collection of rules for capa: the tool for enumerating the capabilities of programs☆543Updated this week
- APT Malware Dataset Containing over 3,500 State-Sponsored Malware Samples☆307Updated 2 years ago
- Self-developed tools for Lateral Movement/Code Execution☆692Updated 3 years ago
- A modular C2 framework☆398Updated this week
- Automatically created C2 Feeds☆533Updated this week
- Process Ghosting - a PE injection technique, similar to Process Doppelgänging, but using a delete-pending file instead of a transacted fi…☆631Updated 8 months ago
- A protective and Low Level Shellcode Loader that defeats modern EDR systems.☆889Updated 8 months ago
- A POC for the new injection technique, abusing windows fork API to evade EDRs. https://www.blackhat.com/eu-22/briefings/schedule/index.ht…☆621Updated last year