qwqdanchun / Malware-NoteLinks
https://docs.qwqdanchun.com/
☆28Updated 4 years ago
Alternatives and similar repositories for Malware-Note
Users that are interested in Malware-Note are comparing it to the libraries listed below
Sorting:
- Basic implementation of Cobalt Strikes - User Defined Reflective Loader feature☆100Updated 2 years ago
- CSharp reimplementation of Venoma, another C++ Cobalt Strike beacon dropper with custom indirect syscalls execution☆45Updated last year
- ☆36Updated 2 years ago
- This is a simple project made to evade https://github.com/thefLink/Hunt-Sleeping-Beacons by using a busy wait instead of beacon's built i…☆34Updated 3 years ago
- ☆42Updated last year
- Indirect NT syscalls LSASS dumper.☆44Updated last year
- "D3MPSEC" is a memory dumping tool designed to extract memory dump from Lsass process using various techniques, including direct system c…☆24Updated 8 months ago
- Simple PoC to locate hooked functions by EDR in ntdll.dll☆36Updated last year
- ProcExp Driver (Ab)use☆22Updated 2 years ago
- ☆54Updated 2 years ago
- Evasive loader to bypass static detection☆60Updated last year
- This project is an EDRSandblast fork, adding some features and custom pieces of code.☆23Updated last year
- A simple PoC of injection shellcode into a remote process and get the output using namepipe☆42Updated last year
- (EDR) Dll Unhooking = kernel32.dll, kernelbase.dll, ntdll.dll, user32.dll, apphelp.dll, msvcrt.dll.☆31Updated 2 weeks ago
- Change hash for a signed pe☆16Updated last year
- Loading Fileless Remote PE from URI to memory with argument passing and ETW patching and NTDLL unhooking and No New Thread technique☆63Updated 2 years ago
- x64 version☆34Updated 3 years ago
- ☆53Updated last year
- A memory-based evasion technique which makes shellcode invisible from process start to end.☆16Updated last year
- Code snippets to add on top of cobalt strike sleepmask kit so that ekko can work in a CFG protected process☆44Updated 2 years ago
- frida based script which automates the process of discovering and exploiting DLL Hijacks in target binaries. The discovered binaries can …☆51Updated 2 years ago
- ☆53Updated 3 years ago
- Explorer Persistence technique : Hijacking cscapi.dll order loading path and writing our malicious dll into C:\Windows\cscapi.dll , when …☆84Updated 2 years ago
- Using LNK files and user input simulation to start processes under explorer.exe☆25Updated 8 months ago
- A method to execute shellcode using RegisterWaitForInputIdle API.☆54Updated 2 years ago
- Neton is a tool for getting information from Internet connected sandboxes☆95Updated 2 years ago
- Rex Shellcode Loader for AV/EDR evasion☆31Updated last year
- Artemis - C++ Hell's Gate Syscall Implementation☆33Updated last year
- ☆47Updated last year
- Windows C++ Implant for Exploration C2☆31Updated last week