Parser for a custom executable formats from Hidden Bee and Rhadamanthys malware
☆60Aug 6, 2025Updated last year
Alternatives and similar repositories for hidden_bee_tools
Users that are interested in hidden_bee_tools are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- A demo implementation of a well-known technique used by some malware to evade userland hooking, using my library: libpeconv.☆20Apr 13, 2018Updated 8 years ago
- Decoders for 7ev3n ransomware☆17Oct 24, 2016Updated 10 years ago
- Parsers for custom malware formats ("Funky malware formats")☆97Jan 8, 2022Updated 4 years ago
- A wrapper for capstone for bearparser☆16Oct 8, 2025Updated last year
- A set of small utilities, helpers for PIN tracers☆40Feb 15, 2026Updated 8 months ago
- AI Agents on DigitalOcean Gradient AI Platform • AdBuild production-ready AI agents using customizable tools or access multiple LLMs through a single endpoint. Create custom knowledge bases or connect external data.
- A process overwriting its own PEB to make an illusion that it has been loaded from a different path.☆100Jun 24, 2021Updated 5 years ago
- BOFs gift wrapped for Havoc☆12Jun 6, 2024Updated 2 years ago
- Parse user-mode minidump files generated on Windows☆17Nov 17, 2025Updated 11 months ago
- Converts a DLL into EXE☆814Jul 23, 2023Updated 3 years ago
- An experimental dynamic malware unpacker based on Intel Pin and PE-sieve☆64Jun 9, 2026Updated 4 months ago
- A CMake template for projects using MS Detours☆24Feb 18, 2025Updated last year
- windows user mode network library☆11Aug 27, 2026Updated 2 months ago
- Programmatically access a TLS certificate chain in C++ and C#☆12Oct 27, 2018Updated 8 years ago
- Plog - A simple and powerful keylogger !☆11Jun 28, 2018Updated 8 years ago
- Serverless GPU API endpoints on Runpod - Get Bonus Credits • AdSkip the infrastructure headaches. Auto-scaling, pay-as-you-go, no-ops approach lets you focus on innovating your application.
- Demos of various (also non standard) persistence methods used by malware☆232Mar 5, 2023Updated 3 years ago
- Standalone Metasploit-like XOR encoder for shellcode☆54May 12, 2024Updated 2 years ago
- A small set of Beacon Object Files (BOFs) that I developed over the time with a Magic: The Gathering theme.☆22Jul 15, 2025Updated last year
- A ready-made template for a project based on libpeconv.☆55Apr 18, 2026Updated 6 months ago
- ChimeraPE (a PE injector type - alternative to: RunPE, ReflectiveLoader, etc) - a template for manual loading of EXE, loading imports pay…☆231Mar 22, 2023Updated 3 years ago
- A more stealthy variant of "DLL hollowing"☆369Mar 8, 2024Updated 2 years ago
- Techniques that i have used to evade anti-virus during pen tests.☆13May 29, 2018Updated 8 years ago
- Python wrappers for mal_unpack☆37Sep 19, 2023Updated 3 years ago
- Set of my small utils related to cryptography, encoding, decoding etc☆96Sep 1, 2025Updated last year
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- Common Malware Techniques☆14Mar 26, 2023Updated 3 years ago
- Set of antianalysis techniques found in malware☆133Aug 25, 2023Updated 3 years ago
- A helper utility for creating shellcodes. Cleans MASM file generated by MSVC, gives refactoring hints.☆190Apr 22, 2025Updated last year
- Archive of ransomware decryptors☆35Dec 7, 2017Updated 8 years ago
- [ARCHIVED] mov rax, ${Thalium/IceBox}; jmp rax;☆76Jun 8, 2019Updated 7 years ago
- Object file loader implemented as a post-ex DLL for asynchronous BOF execution.☆29Jul 23, 2026Updated 3 months ago
- function identification signatures☆12Apr 26, 2021Updated 5 years ago
- IDA plugin to deobfuscate emotet CFF☆18Apr 26, 2022Updated 4 years ago
- Offensive Assembly code snippets.☆15Jul 12, 2023Updated 3 years ago
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- Virtual machine introspection library based on libvmi - parts of this work have been funded by Deutsche Forschungsgemeinschaft (DFG) – pr…☆32Mar 3, 2022Updated 4 years ago
- A spiritual .NET equivalent to the Gargoyle memory scanning evasion technique☆52Dec 6, 2018Updated 7 years ago
- A TCP-Client connected Keylogger in C#☆12Mar 14, 2017Updated 9 years ago
- Import library generator for x86 PE files☆60Apr 8, 2019Updated 7 years ago
- My implementation of enSilo's Process Doppelganging (PE injection technique)☆647Aug 30, 2022Updated 4 years ago
- ☆23Jan 15, 2025Updated last year
- collection of links related to using and improving windbg☆19Jun 17, 2018Updated 8 years ago