hasherezade / hollows_hunter
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
☆2,145Updated 2 weeks ago
Alternatives and similar repositories for hollows_hunter:
Users that are interested in hollows_hunter are comparing it to the libraries listed below
- Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-mem…☆3,271Updated 2 weeks ago
- AV/EDR evasion via direct system calls.☆1,863Updated 2 years ago
- Windows kernel and user mode emulation.☆1,633Updated 2 weeks ago
- A Pin Tool for tracing API calls etc☆1,411Updated 2 months ago
- Dynamic unpacker based on PE-sieve☆723Updated last month
- Identifies the bytes that Microsoft Defender flags on.☆2,430Updated last year
- Nidhogg is an all-in-one simple to use windows kernel rootkit.☆1,936Updated last month
- Shellcode implementation of Reflective DLL Injection. Convert DLLs to position independent shellcode☆2,260Updated last year
- Process Herpaderping proof of concept, tool, and technical deep dive. Process Herpaderping bypasses security products by obscuring the in…☆1,129Updated last year
- A post exploitation framework designed to operate covertly on heavily monitored environments☆2,089Updated 3 years ago
- ☆2,071Updated 2 years ago
- FLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.☆3,503Updated this week
- Generates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from mem…☆3,872Updated 5 months ago
- Great explanation of Process Hollowing (a Technique often used in Malware)☆1,320Updated last year
- PE-bear (builds only)☆776Updated last year
- Converts PE into a shellcode☆2,519Updated last year
- DRAKVUF Sandbox - automated hypervisor-level malware analysis system☆1,119Updated this week
- FakeNet-NG - Next Generation Dynamic Network Analysis Tool☆1,894Updated last week
- AV/EDR evasion via direct system calls.☆1,632Updated 2 years ago
- LSASS memory dumper using direct system calls and API unhooking.☆1,522Updated 4 years ago
- A static analyzer for PE executables.☆1,056Updated last year
- Collaborative Malware Analysis Platform at Scale☆741Updated this week
- Open-Source Shellcode & PE Packer☆1,932Updated last year
- ☆1,624Updated 7 months ago
- A Windows kernel-mode rootkit that abuses legitimate communication channels to control a machine.☆700Updated 4 years ago
- ☆812Updated 5 years ago
- Noriben - Portable, Simple, Malware Analysis Sandbox☆1,149Updated last year
- Living Off The Land Drivers☆1,147Updated 2 weeks ago
- Malware Configuration And Payload Extraction☆2,326Updated last week
- This program is designed to demonstrate various process injection techniques☆1,134Updated last year