FunctionStomping

FunctionStomping Description This is a brand-new technique for shellcode injection to evade AVs and EDRs. This technique is inspired by Module Stomping and has some similarities. As to this date 23-01-2022 alsohollows-hunter doesn't find it. The biggest advantage of this technique is that it isn'...

BadAssMacros

BadAssMacros Description Proof of Concept tool to generate malicious macros leveraging techniques like VBA Purging and Shellcode Obfuscation to evade AV engines. This tool takes in raw shellcode that can be generated by popular C2 frameworks like Metasploit,Cobalt Strike etc and outputs a VBA...

OffensiveVBA

OffensiveVBA In preparation for a VBS AV Evasion Stream/Video I was doing some research for Office Macro code execution methods and evasion techniques. The list got longer and longer and I found no central place for offensive VBA templates - so this repo can be used for such. It is very far away...

OffensiveRust

OffensiveRust My experiments in weaponizing Rust for implant development and general offensive operations. Table of Contents OffensiveRust Why Rust? Examples in this repo Compiling the examples Compiling the examples in this repo Cross Compiling Optimizing executables for size Pitfalls I found...

acheron

About Acheron is a library inspired by SysWhisper3/FreshyCalls/RecycledGate, with most of the functionality implemented in Go assembly. acheron package can be used to add indirect syscall capabilities to your Golang tradecraft, to bypass AV/EDRs that makes use of usermode hooks and instrumentatio...

CobaltWhispers

CobaltWhispers Author: @Cerbersec CobaltWhispers is an aggressor script that utilizes a collection of Beacon Object Files for Cobalt Strike to perform process injection, persistence and more, leveraging direct syscalls to bypass EDR/AV. CobaltWhispers is powered by SysWhispers2 and InlineWhispers...

CarbonCopy

CarbonCopy A tool which creates a spoofed certificate of any online website and signs an Executable for AV Evasion. Works for both Windows and Linux Prerequisites In order to use it on Linux, please execute commands below: apt-get install osslsigncode pip3 install pyopenssl...

wmiexec-Pro

wmiexec-Pro New generation of wmiexec.py. Table of Contents 1. Info 2. Special thanks 3. Features 4. Getting Started Installation 5. Usage 6. Screenshots 7. How it works? 8. Disclaimer 9. References Info The new generation of wmiexec.py, more new features, whole the operations only work with port...

AsmLdr

AsmLdr: A Dynamic Shellcode Loader for Windows x64 Overview AsmLdr is an advanced shellcode loader implemented in x64 assembly language, designed for Windows x64 environments. Its primary purpose is to execute encrypted payloads while minimizing detection by advanced antivirus software, endpoint...

EXOCET-AV-Evasion

EXOCET - AV-evading, undetectable, payload delivery tool Chang Tan AWS Certified Cloud Practitioner and Solutions Architect Associate [email protected] Updated EXOCET Usage Make sure you pack your payloads to avoid any leaks of the crypter's key and further frustrate malware analysts. A...

faxhell

faxhell "Fax Shell" A Proof-of-Concept bind shell using the Fax service and a DLL hijack based on Ualapi.dll. See our writeup at: https://windows-internals.com/faxing-your-way-to-system/ How to use Build Ualapi.dll and place in c:\windows\system32 Start the Fax service, which will load the DLL an...

zombie-zip

Zombie ZIP ZIP format confusion technique that evades 98% of antivirus engines. CVE-2026-0866 | VU976247 | Published March 10, 2026 The Technique Create a ZIP file where: Compression Method = 0 STORED Actual data = DEFLATE compressed CRC-32 = Checksum of uncompressed payload AV Engine: Reads Meth...

LightsOut

LightsOut LightsOut will generate an obfuscated DLL that will disable AMSI & ETW while trying to evade AV. This is done by randomizing all WinAPI functions used, xor encoding strings, and utilizing basic sandbox checks. Mingw-w64 is used to compile the obfuscated C code into a DLL that can be...

bincrypter

Privacy and copyright protection for your programs A Linux Binary Runtime Crypter - in BASH! Obfuscate & encrypt any ELF binary Obfuscate & encrypt any SHELL-script AV/EDR death: Morphing + different signature every time 100% in-memory. No temporary files Not soiling the filesystem Double or trip...

PolyEngine

PolyEngine — Polymorphic PE Packer 📦 PolyEngine is a research-grade, evasive PE packer designed for CTF challenges and low-level Windows security education. It focuses on bypassing EDR and AV heuristics through a layered stack of in-memory execution and obfuscation techniques. This is a side...

ZeroRAT

ZeroRAT Introduction A remote control tool for Windows. The client only needs to execute a single command, utilizing native Windows programs for execution without writing files to disk, providing inherent AV evasion. It becomes ineffective after reboot. In the program, download and upload are fro...

pyobfuscate

pyobfuscate A simple and efficent script to obfuscate python payloads to make it completely FUD Note: 1. Don't Upload Any Payloads To VirusTotal.com Bcz This tool will not work with Time. 2. Virustotal Share Signatures With AV Comapnies. 3. Again Don't be an Idiot! How To Install: 1. git clone...

thorse

THorse THorse is a RAT Remote Administrator Trojan Generator for Windows/Linux systems written in Python 3. This small python script can do really awesome work. Disclaimer :computer: This project was created only for good purposes and personal use. THIS SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRAN...

BeatRev

BeatRev Version 2 Disclaimer/Liability The work that follows is a POC to enable malware to "key" itself to a particular victim in order to frustrate efforts of malware analysts. I assume no responsibility for malicious use of any ideas or code contained within this project. I provide this researc...

Anti_suspend

Antisuspend Just an example of using shellcode to secure a process. Prevents: 1Freezing process threads you can use anti-attach for debugger 2Hardware breakpoints 3Hide thread from the debugger Problem: Use code in non legit modules This will raise the flags of AV...