Reverse engineering analysis of PureRAT, a multi-stage RAT that executes via msbuild.exe and communicates with C2 servers at pure8s.ddnsfree.com and 52.241.248.38. Uses .NET evasion techniques (DisableNativeImageLoad), file system manipulation (DeleteFile, WriteFile, ReadFile), and startup VBScript persistence.
☆19Sep 21, 2026Updated last month
Alternatives and similar repositories for PureRAT-msbuild.exe--C2-Extraction--Net-Evasion-Analysis
Users that are interested in PureRAT-msbuild.exe--C2-Extraction--Net-Evasion-Analysis are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- Active Directory forensic framework☆16May 18, 2026Updated 5 months ago
- ☆25Oct 27, 2026Updated last week
- ☆37Sep 6, 2026Updated 2 months ago
- DynLoader A modular Windows loader focused on EDR evasion Built with indirect syscall (Tartarus Gate / Hell’s Gate), Manual PE parsing …☆82Jul 10, 2026Updated 3 months ago
- ☆22Jun 28, 2026Updated 4 months ago
- Managed hosting for WordPress and PHP on Cloudways • AdManaged hosting for WordPress, Magento, Laravel, or PHP apps, on multiple cloud providers. Deploy in minutes on Cloudways by DigitalOcean.
- Python scripts that helps in the development of PPKG binaries☆16Jul 31, 2026Updated 3 months ago
- Rust based C2 Framework☆35Sep 29, 2026Updated last month
- RingKiller — BYOD PoC for vulnerable driver DCRCVDrv.sys. Abuses IOCTL 0x2205C0 to kill arbitrary processes from ring 0 via ZwTerminatePr…☆26Sep 12, 2026Updated last month
- A cross-platform, collaborative C2 for red-teaming. Agents are cross-compilable (e.g, you can generate Windows DLLs on Linux), cross-comp…☆23Mar 7, 2025Updated last year
- A curated list of red team tools, C2 frameworks, and adversary simulation resources for offensive security professionals.☆26Oct 9, 2026Updated 3 weeks ago
- SVG Steganography toolkit☆17Jun 18, 2026Updated 4 months ago
- Pull-based C2 framework with ten native transports, concurrent multi-profile handlers, and end-to-end ECDSA-signed tasking. Single Go bin…☆34Updated this week
- Hidden Desktop Plugin For Havoc C2,Soon coming for Sliver.☆264Sep 29, 2026Updated last month
- Windows BYOVD research on DCRCVDrv.sys and Alinubx.sys, reverse engineering their kernel primitives, IOCTL surfaces, and detection opport…☆38Oct 27, 2026Updated last week
- 1-Click AI Models by DigitalOcean Gradient • AdDeploy popular AI models on DigitalOcean Gradient GPU virtual machines with just a single click. Zero configuration with optimized deployments.
- Async API security scanner in Rust for CORS, CSP, GraphQL, JWT, OpenAPI, and active API posture checks.☆27Jul 5, 2026Updated 4 months ago
- A zero-symbol static analysis engine that extracts and mathematically ranks the Windows RPC attack surface using an AHP-based risk model.☆16Aug 26, 2026Updated 2 months ago
- A concept of using a ROP chain paired with a WRMSR primitive to call kernel functions and map unsigned drivers through BYOVD (AmdTools64.…☆68Sep 21, 2026Updated last month
- Golang Cobalt Strike Rest API Client☆18Apr 10, 2026Updated 6 months ago
- Modular post-exploitation framework for authorised red-team work. Interactive reverse/bind shells over TCP/TLS/mTLS, plus a pull-based Go…☆39Oct 7, 2026Updated last month
- sharing some outputs for science☆23Sep 26, 2026Updated last month
- Clean Indirect Syscalls with Syscall Tampering.☆52Oct 25, 2026Updated 2 weeks ago
- A IDA CLI tool built on Rust, idalib-rs, and idalib. Supports batch and concurrent IDA analysis processes, design for stateless, agent fi…☆23Sep 15, 2026Updated last month
- Compiled Binaries for Sharp Suite☆15Dec 28, 2019Updated 6 years ago
- Managed Kubernetes at scale on DigitalOcean • AdDigitalOcean Kubernetes includes the control plane, bandwidth allowance, container registry, automatic updates, and more for free.
- I’m building a hands‑on Security Operations Center (SOC) home lab from scratch and documenting my progress as I learn defensive security …☆17Updated this week
- Binary visualiser and triage tool — entropy, byte-class and Hilbert surfaces, dot plots and control-flow graphs over one shared address-s…☆10Aug 26, 2026Updated 2 months ago
- OneDrive as a covert C2 transport for Cobalt Strike☆78Sep 19, 2026Updated last month
- A DEX-to-JVM bytecode converter built to run the output: passes HotSpot's strict verifier, handles 64 KB+ methods and R8-minified apps, ~…☆17Updated this week
- A foundational C library for building operationally credible offensive capabilities☆95Sep 21, 2026Updated last month
- Capability extraction from Time Travel Debugging Traces☆17Aug 4, 2026Updated 3 months ago
- A Purple Team lab simulating Active Directory attacks (Kerberoasting, BloodHound, lateral movement) and implementing defensive hardening …☆39Oct 7, 2026Updated last month
- No-open firmware exploit for the Wyze WLPA19CV2 color bulb☆14Sep 2, 2026Updated 2 months ago
- Deterministic PyGhidra extraction, triage, and local LLM compiler-backend pipeline for C reimplementation.☆11Oct 18, 2026Updated 3 weeks ago
- 1-Click AI Models by DigitalOcean Gradient • AdDeploy popular AI models on DigitalOcean Gradient GPU virtual machines with just a single click. Zero configuration with optimized deployments.
- Build guide for Red Teaming home lab. GOAD lab setup in Proxmox and pfSense, Operator/C2 and Redirectors.☆51Sep 26, 2026Updated last month
- Proof of Concept for Process Code Injection Without Using WriteProcessMemory☆160Sep 27, 2026Updated last month
- Real-time chat app with Nuxt + Cloudflare Durable Objects.☆11Apr 9, 2025Updated last year
- Open test set of .eml emails for checking how email security controls and AI mailbox assistants handle indirect prompt injection. It cros…☆22Oct 31, 2026Updated last week
- Cuban Eight is a red team tool that packages a Windows PE payload into a .wsl file spoofing a real Linux distro installer. Double-click t…☆33Oct 16, 2026Updated 3 weeks ago
- KHAOS is a modern C2 framework that routes agent traffic through cloud services already trusted by enterprise networks.☆252Sep 15, 2026Updated last month
- asmsense: a small model that names and describes functions in stripped x86-64 binaries. Open dataset, baselines, and LoRA experiments.☆20Updated this week