BlackHole

BlackHole C RAT strumento di amministrazione remota Solo a scopo didattico Tecnologie protobuf-net : serializzazione/deserializzazione dei messaggi nel protocollo slavemaster NetMQ : libreria di rete utilizzata per il sistema slavemaster clientserver Lz4.Net : libreria di compressione ILMerge :...

dyen

dyen dyen carica una dylib Mach-O in memoria usando la Python stock di macOS e chiama un entry point esportato senza dlopen su quella dylib. L'obiettivo è che l'immagine non sia mai un file standalone sul target e non venga mai registrata con dyld. di cenobyte [email protected] 2026...

PythonMemoryModule

PythonMemoryModule implementazione pura Python della tecnica MemoryModule per caricare una DLL o un EXE non gestito interamente dalla memoria immagine generata dall'IA di "Python memory module" - hotpot.ai Cos'è PythonMemoryModule è un porting in Python ctypes della tecnica MemoryModule...

ELFLoader

ELFLoader Dies ist ein ELF-Objekt-Loader/Runner im Speicher. Das Ziel ist es, einen einzigen ELF-Loader zu erstellen, der verwendet werden kann, um Folgefunktionen auf allen x8664- und x86-Nix-Betriebssystemen auszuführen. Wie es funktioniert Dieser Loader funktioniert so, dass er den gesamten Co...

FilelessPELoader

FilelessPELoader Carica un PE remoto crittografato AES in memoria, lo decritta e lo esegue Utilizzo : Riferimenti : https://github.com/aplyc1a/PEMemoryLoader?fbclid=IwAR2-VAQo8pJU-tdbSENjhDBdDGi5tyzrnW1S3D9BPAYR6C6-RK4hsEDjDGk Requisiti 1. hashlib 2. pycryptodome 3. pycryptodomex...

Hackers Found Using CrossC2 to Expand Cobalt Strike Beacon's Reach to Linux and macOS

Japan's CERT coordination center JPCERT/CC on Thursday revealed it observed incidents that involved the use of a command-and-control C2 framework called CrossC2, which is designed to extend the functionality of Cobalt Strike to other platforms like Linux and Apple macOS for cross-platform system...

Whispers of Atlantida: Safeguarding Your Digital Treasure

Recently, Rapid7 observed a new stealer named Atlantida. The stealer tricks users to download a malicious file from a compromised website, and uses several evasion techniques such as reflective loading and injection before the stealer is loaded. Atlantida steals a wide range of login information ...

Detecting reflective DLL loading with Windows Defender ATP

Today's attacks put emphasis on leaving little, if any, forensic evidence to maintain stealth and achieve persistence. Attackers use methods that allow exploits to stay resident within an exploited process or migrate to a long-lived process without ever creating or relying on a file on disk. In...

Empire: a PowerShell post-exploitation Agent tools-vulnerability warning-the black bar safety net

Empire is a purely PowerShell post-exploitation Agent tools, it is built on cryptography, secure communications and flexible architecture. Empire realize the need to powershell. exe you can run a PowerShell proxy function. Rapid deployment post-exploit module, from the keyboard recorder to...