hasherezade / hollows_hunter
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
☆2,131Updated last month
Alternatives and similar repositories for hollows_hunter:
Users that are interested in hollows_hunter are comparing it to the libraries listed below
- Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-mem…☆3,256Updated last week
- AV/EDR evasion via direct system calls.☆1,851Updated 2 years ago
- Windows kernel and user mode emulation.☆1,618Updated last month
- Identifies the bytes that Microsoft Defender flags on.☆2,414Updated last year
- Process Herpaderping proof of concept, tool, and technical deep dive. Process Herpaderping bypasses security products by obscuring the in…☆1,128Updated last year
- A post exploitation framework designed to operate covertly on heavily monitored environments☆2,085Updated 3 years ago
- PE-bear (builds only)☆775Updated last year
- FLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.☆3,462Updated 2 weeks ago
- Generates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from mem…☆3,820Updated 5 months ago
- ☆2,064Updated 2 years ago
- Dynamic unpacker based on PE-sieve☆717Updated last week
- A Pin Tool for tracing API calls etc☆1,397Updated last month
- Converts PE into a shellcode☆2,498Updated last year
- Open-Source Shellcode & PE Packer☆1,925Updated last year
- ☆1,617Updated 6 months ago
- Shellcode implementation of Reflective DLL Injection. Convert DLLs to position independent shellcode☆2,245Updated last year
- AV/EDR evasion via direct system calls.☆1,616Updated 2 years ago
- Standard collection of rules for capa: the tool for enumerating the capabilities of programs☆568Updated this week
- LSASS memory dumper using direct system calls and API unhooking.☆1,520Updated 4 years ago
- The multi-platform memory acquisition tool.☆766Updated 3 months ago
- DRAKVUF Sandbox - automated hypervisor-level malware analysis system☆1,111Updated last week
- Malware Configuration And Payload Extraction☆2,268Updated this week
- FakeNet-NG - Next Generation Dynamic Network Analysis Tool☆1,878Updated 2 months ago
- Windows Event Log Killer☆1,777Updated last year
- Set of tools to analyze Windows sandboxes for exposed attack surface.☆2,133Updated 3 months ago
- Living Off The Land Drivers☆1,137Updated 3 weeks ago
- Great explanation of Process Hollowing (a Technique often used in Malware)☆1,311Updated last year
- Collaborative Malware Analysis Platform at Scale☆740Updated last week
- Noriben - Portable, Simple, Malware Analysis Sandbox☆1,143Updated last year
- ☆806Updated 5 years ago