WTSRM

WTSRM - Repositório de demonstração do malware Writing Tiny Small Reliable Malware para a minha palestra. Remove o unhook de todas as DLLs do Windows com \KnownDlls\ Sem dependências de CRT Tamanho pequeno Baixa entropia Chave de criptografia de strings aleatória portanto, sem strings em texto pu...

DarkWidow

DarkWidow Uno strumento Dropper personalizzabile mirato a Windows. Menzioni d'Onore: 1. BlackHat Asia, 2024 - Call For Tools 2. BlackHat USA, 2024 - Call For Tools 3. BlackHat SecTor, 2024 - Call For Tools 4. BlackHat Europe, 2024 - Call For Tools 5. Wild West Hacking Fest 2024 - Arsenal Un grand...

LoadReload

LoadReload Caricatore di shellcode basato su ciò che ho realizzato per la mia tesi di laurea magistrale, progettato per Sliver-Shellcode più piccolo di 25MB..... !Note Caratteristiche: Decrittazione Multibyte-XOR del Payload Recupero del Payload localmente Anti-Emulazione tramite funzione BusySle...

Ares

Progetto Ares Injector di Project Ares Project Ares Injector è un loader Proof of Concept PoC scritto in C/C++ basato sulla tecnica Transacted Hollowing. Il loader inietta un PE in un processo remoto e presenta le seguenti caratteristiche: Spoofing del PPID CIG per bloccare i binari non firmati...

MalDev

MalDev Hallo! Willkommen in meinem Repo : Ich bin Captain Magma, eine leidenschaftliche Person, die sich der Cybersicherheit, der Malware-Entwicklung und -Analyse widmet. Der Zweck dieses Repositorys ist es, meinen MalDev-Lernpfad zu verwalten, während ich lerne und dieses Repository mit meinen...

NixImports

NixImports Ein .NET-Malware-Loader, der API-Hashing und dynamisches Aufrufen verwendet, um statische Analysen zu umgehen Wie funktioniert es? NixImports verwendet meine verwaltete API-Hashing-Implementierung HInvoke, um die meisten seiner aufgerufenen Funktionen zur Laufzeit dynamisch aufzulösen...

AtlasLdr

Atlas é um carregador reflexivo x64 que possui os seguintes recursos: Recursos Recuperação de DLL e PE de um servidor remoto Manual Mapping em um processo remoto Apagamento do cabeçalho DOS e dos bytes mágicos do NTHeader Código independente de posição Uso de Syscalls indiretas ZwOpenProcess...

NixImports - A .NET Malware Loader, Using API-Hashing To Evade Static Analysis

A .NET malware loader, using API-Hashing and dynamic invoking to evade static analysis How does it work? NixImports uses my managed API-Hashing implementation HInvoke, to dynamically resolve most of it's called functions at runtime. To resolve the functions HInvoke requires two hashes the typeHas...

AtomLdr - A DLL Loader With Advanced Evasive Features

A DLL Loader With Advanced Evasive Features Features: CRT library independent. The final DLL file, can run the payload by loading the DLL executing its entry point, or by executing the exported "Atom" function via the command line. DLL unhooking from \KnwonDlls\ directory, with no RWX sections. T...

Unveiling the Malicious Tactics of LokiBot Malware

Threat Level Attack Report Follow Hive Pro for a detailed threat advisory, download the pdf file here from HiveForce Labs. Summary LokiBot is a constantly evolving information-stealing malware that creates a backdoor on infected machines to collect sensitive data, and it uses ISO files and API...

TerraLdr - A Payload Loader Designed With Advanced Evasion Features

TerraLdr: A Payload Loader Designed With Advanced Evasion Features Details: no crt functions imported syscall unhooking using KnownDllUnhook api hashing using Rotr32 hashing algo payload encryption using rc4 - payload is saved in .rsrc process injection - targetting 'SettingSyncHost.exe' ppid...

Applied YARA training Q&A

Introduction On August 31, 2021 we ran a joint webinar between VirusTotal and Kaspersky, with a focus on YARA rules best practices and real world examples. If you didnt have the chance to watch the webinar live, you can see it as a recording on Brighttalk: Applied YARA training. During the webina...

A Deep Dive Into RIG Exploit Kit Delivering Grobios Trojan

As discussed in previous blogs, exploit kit activity has been on the decline since the latter half of 2016. However, we do still periodically observe significant developments in this space, and we have been observing interesting ongoing activity involving RIG Exploit Kit EK. Although the volume o...

New Point-of-Sale Malware LockPoS Hitches Ride with FlokiBot

Botnets distributing FlokiBot point-of-sale malware have awoken from months of slumber and are back in business spewing a new malware dubbed LockPoS. Researchers say the malware is still flying under the radar of many antivirus and intrusion detection systems because it’s so new. Currently, LockP...