Chrome-App-Bound-Encryption-Decryption

ChromElevator Chrome App-Bound Encryption Decryption 🚀 Overview A post-exploitation tool demonstrating a complete, in-memory bypass of Chromium's App-Bound Encryption ABE. This project utilizes Direct Syscall-based Reflective Process Hollowing to launch a legitimate browser process in a suspended...

ghost

Ghost Ghost is a process injection detection tool written in Rust. It watches running processes and tries to catch suspicious stuff like code injection, memory manipulation, and other tricks that malware uses to hide. What it does The main idea is simple: scan processes and look for weird memory...

process_overwriting

Sobrescritura de Procesos La Sobrescritura de Procesos es una técnica de inyección de PE, estrechamente relacionada con Process Hollowing y Module Overloading. Con su ayuda, puedes reemplazar el ejecutable principal no una DLL del proceso objetivo. Funciona solo para un proceso recién creado: la...

pe-sieve

Introducción PE-sieve es una herramienta que ayuda a detectar malware en ejecución en el sistema, así como a recolectar el material potencialmente malicioso para su posterior análisis. Reconoce y vuelca una variedad de implantes dentro del proceso escaneado: PE reemplazados/inyectados, shellcodes...

memhunter

Memhunter Automated hunting of memory resident malware at scale This project is WORK IN PROGRESS. Expect feature changes and binary releases on the upcoming weeks. Overview Memhunter is an endpoint sensor tool that is specialized in detecing resident malware, improving the threat hunter analysis...

PichichiH0ll0wer

PichichiH0ll0wer PichichiH0ll0wer About Features Injection methods Installation Usage Credits About --== Process hollowing loader written in Nim for PEs only ==-- I built PichichiH0ll0wer to learn and contribute, sure. but also because I'm quite tired of shellcodes everywhere. Loading PEs might b...

GhostlyHollowingViaTamperedSyscalls2

Ghostly Hollowing Via Tampered Syscalls Reupload Notice !NOTE The original repository previously used an incorrect license that omitted attribution to the founder of DeceptIQ, @Rad9800, whose TamperingSyscalls repository is published under the MIT License. His work was already credited in the...

SharpBlock

SharpBlock A method of bypassing EDR's active projection DLL's by preventing entry point execution. Features Blocks EDR DLL entry point execution, which prevents EDR hooks from being placed. Patchless AMSI bypass that is undetectable from scanners looking for Amsi.dll code patches at runtime. Hos...

ProcessInjection

ProcessInjection The program is designed to perform process injection. Currently the tool supports 5 process injection techniques. root@kitploit: 1 Vanilla Process Injection 2 DLL Injection 3 Process Hollowing 4 APC Queue 5 KernelCallbackTable Injection The tool accepts shellcode in 4 formats...

hollows_hunter

hollowshunter...

hollows_hunter

hollowshunter Hollows Hunter is a command-line application based on PE-sieve passive memory scanner. Recognizes and dumps a variety of potentially malicious implants replaced/implanted PEs, shellcodes, hooks, in-memory patches. While in case of PE-sieve you can select the process only by its PID,...

Sharperner

Sharperner Sharperner is a tool written in CSharp that generate .NET dropper with AES and XOR obfuscated shellcode. Generated executable can possibly bypass signature check but I cant be sure it can bypass heuristic scanning. Features PE binary Process Hollowing PPID Spoofing Random generated AES...

StealC-Stealer-RuntimeBroker-Hollowing-C2-Extraction-Payload-Extraction-Analysis

1. RuntimeBroker.exe Hollowing & C2 IP Addresses Process Hacker memory analysis reveals that StealC Stealer performs process hollowing on RuntimeBroker.exe and establishes connections to multiple C2 servers. Key Observations: Target Process: RuntimeBroker.exe PID 14900. C2 IP Addresses:...

avet

Herramienta de Evasión de Antivirus AVET ya no se desarrolla debido a limitaciones técnicas y de tiempo. AVET es una herramienta de evasión de antivirus, desarrollada para facilitar la vida de los pentesters y para experimentar con técnicas de evasión de antivirus, así como otros métodos utilizad...

PELoader

PELoader PELoader implement various shellcode injection techniques, and use libpeconv library to load encrypted PE files instead of injecting shellcode into remote thread. Following techniques were implemented: Module Stomping LoadLibrary Module Stomping NtMapViewOfSection PoC Transacted Hollowin...

Vidar-Stealer-Reverse-Engineering

Vidar Stealer 2.0 Reverse Engineering Analysis Overview This analysis covers an in-depth reverse engineering of Vidar Stealer 2.0 , a sophisticated information stealer that uses advanced evasion techniques to remain undetected. Key findings include: Task Scheduler Tampering: Modifies system task...

patriot

Patriot メモリ内で動作するさまざまなステルス技術を検出するための小規模な研究プロジェクトです。 最新リリースはこちらからダウンロードできます。 現在のバージョンは以下の検出に対応しています： VirtualProtect関数を指す不審なCONTEXT構造体。Austin Hudsonによる研究とFoliage、およびCracked5piderによるEkkoを対象としています。 プロセス・ホローイングの亜種を検出するための、メモリ内のMZ/PEヘッダーの検証。 ファイルにバックされていない実行可能領域が高整合性で実行されていること。...

Shinigami

Shinigami Shinigami is an experimental tool designed to detect and unpack malware implants that are injected via process hollowing or generic packer routines. How this works The tool operates by hooking NT functions related to Process Hollowing and marking newly executable memory pages with the...

Kernel-Process-Hollowing

Windows Kernel Mode Process Hollowing This project is a proof of concept of how the Process Hollowing technique works from the kernel level. Resources SSDT Hook Process Hollowing...

Percino

Percino Evasive Golang Loader Percino is a Golang loader that execute shellcode utilizing the process hollowing technique with anti-sandbox and anti-analysis measures. The shellcode is encrypted with the Triple DES 3DES encryption algorithm. Full EDR bypass with any C2 Framework. Tested with Coba...