44076 matches found
Malware-IOCs
Malware-IOCs This is where I'll post IOCs from malware investigations...
Qakbot
This repository does not have a README...
IDAPython-Malware-Scripts
IDAPython-Malware-Scripts I have included the scripts that I use to automate analysis. Feel free to use them and submit issues/PRs if you think I miss anything or make mistakes!...
Malware-IOCs
Malware-IOCs Just my findings of malwares...
Apache HTTP server v2.4.0 to v2.4.39 - Open Redirect
In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with modrewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an unexpected URL within the request URL. id: CVE-2019-10098 info: name: Apache HTTP server v2.4.0 to v2.4.39 - Open...
BruteRatel-DetectionTools
BruteRatel-DetectionTools A collection of Tools and Rules for decoding Brute Ratel C4 badgers All tools and rules are based on samples identified by PaloAlto in their report https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/ Yara Rule The yara rule has been tested against the samples includ...
WTSRM
WTSRM - Writing Tiny Small Reliable Malware demo repository for my corresponding talk. Unhooks all Windows Dlls with \KnownDlls\ No CRT dependencies Small size Low entropy Random string encryption key thus no plaintext strings API hashing Hook detection Walks around hooks for initial unhooking on...
mwcfg
恶意软件配置提取器 用于 MalDuck 的恶意软件配置提取工具与模块 本项目完全免费，如同免费的 🍺，你可以将其用于商业、私人或任何你认为合适的方式。 使用本项目最简单的方式是访问 mwcfg.info，立即开始提取恶意软件配置！ 如果你喜欢本项目并希望捐赠 💰 以支持对抗恶意软件的战斗…… 请给我买杯 🍵，因为我不喝 🍺，你可以向 16oXesi7uv3jdPZxxwarHSD2f3cNMpaih9 发送一些 ₿ 安装： root@kitploit: sudo apt update sudo apt install -y python-virtualenv...
MalwareApiLibrary
MalwareApiLibrary : collection of apis used for malware development : StringManagementLib : manage strings, string hashes, and others WinApiManagementLib : replacement of GetModuleHandle and GetProcAddress functions SyscallsManagementLib : runs Hellsgate, TartarusGate, PerunsFart so far to unhook...
YaraRules
YaraRules I share YARA rules in this repo...
Maldoc-Analysis
Maldoc-Analysis In March 2023, a new sample was identified as malware. The malware originated from files with .xls and .doc extensions and is known as "Bank Slip.xls". The malware's activity is related to vulnerabilities identified as CVE-2017-11882 and CVE-2018-0802...
CVE-2020-24089
CVE-2020-24089 Windows Privilege Escalation An issue was discovered in ImfHpRegFilter.sys in IOBit Malware Fighter version 8.0.2, allows local attackers to cause a denial of service DoS. CVE Link - https://vulners.com/cve/CVE-2020-24089...
CVE-2025-66478
CVE-2025-66478 - Next.js Server Actions RCE 漏洞實際攻擊日誌分析 概述 本專案收集了一個暴露在網際網路上的 Next.js 15.1.2 應用程式（執行於 Docker 容器中）所記錄的真實攻擊日誌。這些日誌展示了 CVE-2025-66478 漏洞在野外被大量自動化攻擊工具掃描和利用的情況。 紀錄時間範圍 : 2025-12-04 2025-12-06（約 48 小時） 環境資訊 : 框架: Next.js 15.1.2 執行環境: Bun v1.2.20 容器: Docker Alpine Linux 時區: Asia/Taipei...
MalwareForge---Advanced-Static-Malware-Analyzer
🛡️ MalwareForge - Advanced Static Malware Analyzer MalwareForge is a powerful static malware analysis tool that detects malicious behavior without executing the file. ✨ Features 🦠 Behavior Analysis : Process Injection, Persistence, Network, Stealer, Evasion 💉 8 Injection Techniques : Process...
pmg
Package Manager Guard PMG Block malicious npm and pip packages before they install. Defense in depth for the package managers you already use...
GarbageMan
GarbageMan What is GarbageMan? GarbageMan is a set of tools designed for .NET heap analysis. These tools offer the following benefits for malware researchers: Ability to extract clear-text payload PE Images etc. from .NET heaps quickly. Easy analysis of encrypted network protocols, signs of data...
Apache Tomcat - Open Redirect
Apache Tomcat versions prior to 9.0.12, 8.5.34, and 7.0.91 are prone to an open-redirection vulnerability because it fails to properly sanitize user-supplied input. id: CVE-2018-11784 info: name: Apache Tomcat - Open Redirect author: geeknik severity: medium description: | Apache Tomcat versions...
VolleyballSquid-----CVE-2023-38831-and-Bypass-UAC
VolleyballSquid-----CVE-2023-38831-and-Bypass-UAC This is my malware. I use the CVE 2023-38831, a kind of exploit on WinRAR, to do this malware. I also use BypassUAC to get Administrator authority. This is the OVA file of it:...
hashdb
HashDB HashDB is a community-sourced library of hashing algorithms used in malware. How To Use HashDB HashDB can be used as a stand alone hashing library, but it also feeds the HashDB Lookup Service run by OALabs. This service allows analysts to reverse hashes and retrieve hashed API names and...