VolleyballSquid-----CVE-2023-38831-and-Bypass-UAC

VolleyballSquid-----CVE-2023-38831-and-Bypass-UAC This is my malware. I use the CVE 2023-38831, a kind of exploit on WinRAR, to do this malware. I also use BypassUAC to get Administrator authority. This is the OVA file of it:...

hashdb

HashDB HashDB is a community-sourced library of hashing algorithms used in malware. How To Use HashDB HashDB can be used as a stand alone hashing library, but it also feeds the HashDB Lookup Service run by OALabs. This service allows analysts to reverse hashes and retrieve hashed API names and...

CVE-2024-4577-Exploitation-AsyncRAT-Deployment-DFIR-Investigation

" CVE-2024-4577 AsyncRAT DFIR Investigation"...

Abused-Legitimate-Services

Abused Legitimate Services Legitimate third-party Platform-as-a-Service PaaS providers are becoming increasingly leveraged by threat actors for phishing and malware deployment. PaaS providers such as cloud instances, marketing platforms, content delivery networks CDN, and dynamic DNS servers have...

Malware-Analysis

Malware Analysis A repository to organize my malware write-ups that are too long or just don't work as Twitter threads...

CVE-2023-38831-KQL

CVE-2023-38831 - WinRAR File Extension Spoofing Vulnerability Description Cybercriminals have exploited a vulnerability allowing them to spoof file extensions. This means they can hide the launch of malicious scripts within archives pretending to be common file types such as .jpg, .txt, etc. This...

Exploit-Win32.CVE-2012-0158.F.doc

Exploit-Win32.CVE-2012-0158.F.doc the name of virus is the detection of microsoft defender, is the tipic antivirus...

pe-bear-old

PE-bear releases PE-bear is a freeware reversing tool for PE files. Its objective is to deliver fast and flexible “first view” for malware analysts, stable and capable to handle malformed PE files. Signatures for PE-bear: SIG.txt updated: 22.01.2014 - contains signatures fromPEid's UserDB -...

PsyloDbg

PsyloDbg PsyloDbg is a fast-growing and user-friendly open-source Windows Debugger entirely coded in Delphi. The main goal of this project is to offer to Malware analysts another tool to short their response time during their analysis process. The project is still in very early stage, it is...

upx-recovery-tool

upx-recovery-tool upx-recovery-tool is a script that aims to repair the most common modifications done by malware creators to ELF UPX-compressed files done to prevent their automatic unpacking with a standard UPX tool. Implemented UPX fixes / Features This tool detects and repairs the following...

2022

100 Days of YARA Part 2 - Electric Detectaloo Apologies in advance for the terrible naming, but welcome to 100 Days of YARA! This repository will act as the store for all YARA ideas created during this time. Any fun scripts, tools, or rules you write can be committed to this GitHub repository! Fo...

Endurance-Wiper

Endurance-Wiper Beta - Open Source A small wiper malware written in C using the .NET framework. If you are from Twitter or any other source, you can clearly tell this is in active development. You are free to check the updates here...

IATelligence

IATelligence IATelligence is a Python script that extracts the Import Address Table IAT from a PE file and uses OpenAI's GPT-3 model to provide details about each Windows API imported by the file. The script also searches for related MITRE ATT&CK techniques and explains how the API could...

de4dot

Description de4dot is an open source GPLv3 .NET deobfuscator and unpacker written in C. It will try its best to restore a packed and obfuscated assembly to almost the original assembly. Most of the obfuscation can be completely restored eg. string encryption, but symbol renaming is impossible to...

ThreatResearch

Config Extractors Some used scripts by our team to extract configs from some analyzed samples. PlugX Remcos templateX RedLine Stealer...

CyberThreatIntel

CyberThreatIntel Analysis of malware and Cyber Threat Intel of APT and cybercriminals groups Summary 2020-01-20 - Transparent Tribe APT 2020-01-03 - MAAS Terraloader 2019-12-28 - SideWinder same targets, same TTPs, time to counter-attack ! 2019-11-18 - APT33 continue to target US companies...

defcon_27_windbg_workshop

"Modern Debugging with WinDbg Preview" DEFCON 27 workshop This repository contains the materials for the DEFCON 27 workshop Overview Abstract It's 2019 and yet too many Windows developers and hackers alike rely on useful but rather old school tools for debugging Windows binaries OllyDbg, Immunity...

MalwareConfigLists

MalwareConfigLists Just some lists of Malware Configs...

malware_analysis

Malware Analysis...

secret_handshake

Secret Handshake - A Malware C2 Channel Using x509 Certs Over mTLS Motivation First off, why would I open source this? MITRE ATT&CK only talks about stolen or self-signed certs, and NDRs as far as I can tell pay very little attention to the content of x509 certificates outside of who is the issui...