Alternatives and similar repositories for XenoStealerLib

Users that are interested in XenoStealerLib are comparing it to the libraries listed below

• timwhitez / JmpUnhook
  Ntdll Unhooking POC
  ☆19Updated 2 years ago
• 0x3rhy / GetClipboard
  Cobalt Strike Get clipboard plugin
  ☆13Updated last year
• Octoberfest7 / Backstab_BOF
  Beacon Object File implementation of Yaxser's Backstab
  ☆15Updated 3 years ago
• GetRektBoy724 / SysGate
  One gate to all syscalls!
  ☆23Updated 3 years ago
• ASkyeye / CobaltPatch
  Cobalt Strike Malleable Profile Inline Patch Template: A Position Independent Code (PIC) Code Template For Creating Shellcode That Can Be…
  ☆40Updated 4 years ago
• MaorSabag / fileSearcher
  A simple BOF (Beacon Object File) to search files in the system
  ☆14Updated last year
• VoldeSec / BOF-NPPSPY
  Porting of NPPSPY by Grzegorz Tworek to 'man in the middle' the user logon process, and store the user's name and password in an unassumi…
  ☆18Updated 2 years ago
• Kudaes / Scripts
  Repository for dirty scripts and PoCs
  ☆17Updated 2 months ago
• TomOS3 / UserModeUnhooking
  This project is created for research into antivirus evasion by unhooking.
  ☆15Updated 3 years ago
• jsecu / ElevatedEvents
  ☆29Updated 2 years ago
• Quack2332 / Simple-.NET-Obfuscator-PoC
  ☆20Updated 11 months ago
• CryptoBreach / UnhookPoC
  A small PoC using DInvoke, dynamically mapping a DLL and executing Win32 APIs for process injection.
  ☆10Updated 3 years ago
• thiagomayllart / DarkMelkor
  Modified Version of Melkor @FuzzySecurity capable of creating disposable AppDomains in injected processes.
  ☆28Updated 3 years ago
• GetRektBoy724 / SharpLoadLibrary
  An attempt to make a LoadLibrary designed for offensive operations, in C# obviously.
  ☆55Updated 3 years ago
• ChoiSG / havoc2nginx
  havoc2nginx is a simple python script that converts Havoc Framework's yaotl malleable c2 profile to Nginx configuration file format. Most…
  ☆11Updated 2 years ago
• cocomelonc / 2022-04-02-malware-injection-18
  Find kernel32 base and API addresses. Simple C++ implementation
  ☆24Updated 3 years ago
• 0x3rhy / BypassCredGuard-BOF
  BypassCredGuard CS BOF
  ☆38Updated 3 months ago
• KingOfTheNOPs / ChangeWallpaper-BOF
  Cobalt Strike Beacon Object File to to change the user's desktop wallpaper
  ☆13Updated last year
• trainr3kt / Readfile_BoF
  ☆21Updated 2 years ago
• Gr1mmie / SharpShellCodeObfus
  Caeser Cipher your shellcode!
  ☆20Updated 3 years ago
• Faran-17 / EarlyBird-APC-Injection
  Demonstration of Early Bird APC Injection - MITRE ID T1055.004
  ☆32Updated last year
• ScriptIdiot / sleepmask_ekko_cfg
  Code snippets to add on top of cobalt strike sleepmask kit so that ekko can work in a CFG protected process
  ☆44Updated 2 years ago
• FalconForceTeam / bof-winrm-plugin-jump
  ☆27Updated 3 months ago
• wolfcod / beacondbg
  Beacon Debugger
  ☆40Updated 6 months ago
• EvilBytecode / Amsi-Patch-Updated-2025
  How to bypass AMSI (Antimalware Scan Interface) in PowerShell/C++ by dynamically patching the AmsiScanBuffer function.
  ☆17Updated 3 weeks ago
• ZephrFish / DynamicMSBuilder
  A Dynamic MSBuild task to help with minor obfuscation of C# Binaries to evade static signatures on each compilation
  ☆36Updated 3 weeks ago
• clod81 / loader_process_hollow_copy_in_chunk
  About C# loader that copies a chunk at the time of the shellcode in memory in a suspended process, rather that all at once
  ☆12Updated 2 years ago
• sud0Ru / impacket-dcom
  Adjusted version of the impacket-dcomexec script to work against Windows 10
  ☆10Updated 11 months ago
• EricEsquivel / OpsLoader
  A Cobalt Strike payload generator and lateral movement aggressor script which places Beacon shellcode into a custom shellcode loader
  ☆36Updated 7 months ago
• dis0rder0x00 / ParentProcessManipulation-LNK
  Using LNK files and user input simulation to start processes under explorer.exe
  ☆25Updated 7 months ago