h3xduck / Umbra
A LKM rootkit targeting 4.x and 5.x kernel versions which opens a backdoor that can spawn a reverse shell to a remote host, launch malware and more.
☆118Updated 3 years ago
Related projects ⓘ
Alternatives and complementary repositories for Umbra
- LD_PRELOAD rootkit☆121Updated 8 months ago
- A local LKM rootkit loader/dropper that lists available security mechanisms☆52Updated 3 years ago
- A Flask-based HTTP(S) command and control (C2) with a web frontend. Malleable agent written in Go.☆35Updated last year
- EDR Detector that can find what kind of endpoint solution is being used according to drivers in the system.☆86Updated 3 years ago
- An attempt to restore and adapt to modern Win10 version the 'Rootkit Arsenal' original code samples☆66Updated 2 years ago
- ☆111Updated 2 years ago
- Winsock accept() Backdoor Implant.☆110Updated 3 years ago
- ☆82Updated 2 years ago
- Evasion Escaper is a project aimed at evading the checks that malicious software performs to detect if it's running in a virtual environm…☆99Updated last year
- bdvl☆107Updated 2 years ago
- BPFDoor Source Code. Originally found from Chinese Threat Actor Red Menshen☆40Updated 2 years ago
- Linux Kernel module-less implant (backdoor)☆66Updated 3 years ago
- Code snippets for bare-metal malware development☆96Updated 2 years ago
- Grab Firefox post requests by hooking PR_Write function from nss3.dll module using trampoline hook to get passwords and emails of users☆42Updated 2 years ago
- ☆33Updated last year
- ☆33Updated last year
- Batch script to compile a binary shellcode blob into an exe file☆80Updated 5 years ago
- A Flask-based HTTP(S) command and control (C2) framework with a web interface. Custom Windows EXE/DLL implants written in C++. For educat…☆87Updated last year
- Detect strange memory regions and DLLs☆168Updated 2 years ago
- Finding secrets in kernel and user memory☆113Updated last year
- Windows APT Warfare, published by Packt☆66Updated last year
- Exploit Development - Weaponized Exploit and Proof of Concepts (PoC)☆217Updated last year
- Evasive Process Hollowing Techniques☆134Updated 4 years ago
- Standalone Metasploit-like XOR encoder for shellcode☆45Updated 5 months ago
- ☆87Updated 4 years ago
- Building and Executing Position Independent Shellcode from Object Files in Memory☆153Updated 3 years ago
- Resources and articles I need to take a look at. Mostly about malware/exploit development and analysis.☆81Updated 2 years ago
- (Sim)ulate (Ba)zar Loader☆29Updated 3 years ago