bn-uefi-helper

bn-uefi-helper ATTENZIONE: Questo plugin è stato deprecato. Vedi EFI Resolver Descrizione Plugin helper per l'analisi del firmware UEFI. Questo plugin contiene le seguenti funzionalità: Applica il prototipo corretto alla funzione di punto di ingresso Corregge i segmenti in modo che tutti siano RW...

BOF_RunPe

BOFRunPE BOF RunPE è un Beacon Object File per Cobalt Strike che esegue file PE interamente in memoria all'interno del processo del beacon. A differenza del tradizionale fork&run, nessun processo figlio viene generato, nessuna console viene creata e nessuna pipe viene utilizzata - tutto l'output...

Nim-RunPE

Nim-RunPE Un'implementazione in Nim di reflective PE-Loading dalla memoria. La base di questo codice è stata presa da RunPE-In-Memory - che ho portato in Nim. Dovrai installare le seguenti dipendenze: nimble install ptrmath winim Ho testato questo solo con Nim versione 1.6.2, quindi usa quella...

InflativeLoading

InflativeLoading Artigo: https://winslow1984.com/books/malware/page/reflectiveloading-and-inflativeloading Histórico de Principais Atualizações Nesta seção, são fornecidas as principais atualizações. As principais atualizações incluem suportes ou recursos adicionados. 4/11/2024 Adicionada Ofuscaç...

IronPE

IronPE - Rust में लिखा गया न्यूनतम Windows PE मैनुअल लोडर। Rust PE लोडर / मैनुअल मैपिंग कार्यान्वयन IronPE Rust में लिखा गया एक न्यूनतम Windows PE मैनुअल लोडर है जो x86 और x64 दोनों PE फ़ाइलों के लिए है। यह प्रोजेक्ट मेरे पिछले प्रोजेक्ट dotNetPELoader का Rust पुनःकार्यान्वयन है, जिसने C में एक...

CrimsonEDR - Simulate The Behavior Of AV/EDR For Malware Development Training

CrimsonEDR is an open-source project engineered to identify specific malware patterns, offering a tool for honing skills in circumventing Endpoint Detection and Response EDR. By leveraging diverse detection methods, it empowers users to deepen their understanding of security evasion tactics...

New SPECTRALVIPER Backdoor Targeting Vietnamese Public Companies

Vietnamese public companies have been targeted as part of an ongoing campaign that deploys a novel backdoor called SPECTRALVIPER. "SPECTRALVIPER is a heavily obfuscated, previously undisclosed, x64 backdoor that brings PE loading and injection, file upload and download, file and directory...

Nim-RunPE - A Nim Implementation Of Reflective PE-Loading From Memory

A Nim implementation of reflective PE-Loading from memory. The base for this code was taken from RunPE-In-Memory - which I ported to Nim. You'll need to install the following dependencies: nimble install ptrmath winim I did test this with Nim Version 1.6.2 only, so use that version for testing or...