CVE-2026-3502-Scanner---TrueConf-Vulnerability-Detection-Tool

🔍 CVE-2026-3502 スキャナー - TrueConf 脆弱性検出ツール ⚠️ 警告 教育目的および許可されたテストのみを対象としています。 📋 説明 CVE-2026-3502 用の検出ツールです。更新確認なしで TrueConf サーバーをスキャンし、脆弱な Windows クライアント（≤8.5.3.884）を検出し、TrueChaos の IOC（PowerISO、レジストリの永続化、スケジュールされたタスク）を検索します。 📦 インストール git clone https://github.com/tu-usuario/CVE-2026-3502-Scanner.git...

RustyWater-ShellCode-Dropper

RustyWater ShellCode Dropper RustyWater는 Static Kitten 그룹 공격에서 주요 페이로드이자 전체 적대적 작전의 핵심을 나타냅니다. RustyWater는 Rust로 컴파일된 실행 파일가짜 Cloudflare 아이콘을 가진 reddit.exe로 위장로, 프로세스 인젝션 및 레지스트리 기반 지속성을 통해 강력한 AV/EDR 회피 기능을 갖춘 것으로 알려져 있습니다RustyWater, 또는 Archer RAT/RUSTRIC와 연관됨. 1-안티 분석 Reddit.exe는 모니터링, 가상화 또는...

SharpHide

SharpHide Just a nice persistence trick to confuse DFIR investigation. Uses NtSetValueKey native API to create a hidden null terminated registry key. This works by adding a null byte in front of the UNICODESTRING key valuename. More info about this technique can be found in the following...

Shell3er

Shell3er Shell3er PowerShell Reverse Shell The Shell3er Reverse Features Get-RandomProcessName Function The Get-RandomProcessName function generates a random process name by concatenating "PS" with a new GUID. This is used to create unique and seemingly random process names, making it harder to...

spybrowse

BrowseSpy 코드 전체에 있는 ftp 변수를 반드시 변경하세요. 이 변수에는 파일을 수신하는 FTP 서버의 사용자 이름, 비밀번호 및 IP 주소가 포함됩니다. 이 코드는 다음을 수행합니다: 1. 자신을 %TMP% 디렉터리에 복사하고 이름을 ursakta.exe로 변경합니다. 2. 사용자가 로그인할 때마다 실행되도록 레지스트리 항목을 추가합니다. 3. 사용 중인 브라우저Chrome, Firefox 또는 Brave를 확인합니다. 4. Chrome, Firefox 또는 Brave 브라우저 디렉터리 내의 파일을 검색합니다. 5...

Palsy-Virus

Palsy Virus 실행되면 PC를 마비시키는 Python 바이러스로, 스스로를 숨기고 레지스트리 시작 항목에 자신을 추가합니다 ^^ 플랫폼 : -- Windows 전용 :P...

-Remcos-RAT-Fileless-svchost-Injection-Obfuscated-Payload-Analysis-

1. Remcos – Native API 호출을 통한 svchost 인젝션 다음 Binary Ninja 스니펫은 Remcos가 svchost.exe에 페이로드를 주입하는 데 사용하는 핵심 인젝션 메커니즘을 보여줍니다. 이 코드가 하는 일: CreateProcessW 와 CREATESUSPENDED 플래그를 사용하여 중단된 상태의 새 svchost 프로세스를 시작합니다. VirtualAlloc 은 MEMCOMMIT 및 PAGEREADWRITE 플래그를 사용하여 대상 프로세스 내에 메모리를 할당하므로 페이로드를 프로세스 메모리에...

BOF_Collection

BOFCollection さまざまな Cobalt Strike BOF 必要条件 beacon.h コンパイル手順とBOFの概要については、help-bof を参照してください。 ActiveDirectory GetDomainInfo.c 現在のドメインとドメインコントローラーに関する情報を返します。 inline-execute GetDomainInfo.o Collection GetClipboard.c クリップボード上のテキストを表示します。 inline-execute GetClipboard.o dumpwifi.c...

MAL-2026-16059 Malicious code in rojo-rbx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8bf25c0dd3a1b933c3ee2fe887301590c3b92e383a1e6c380fcdb9544578720b The package impersonates the legitimate Rojo Roblox tooling project. Its npm install lifecycle runs scripts/install.js, which on Windows downloads a...

Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks

Threat actors are leveraging the trusted Node.js JavaScript runtime in multiple cyber attacks as a way to deploy malicious payloads. According to a new report published by the Symantec Threat Hunter Team today, the attack method has been put to use in attacks targeting government departments,...

Windows Time Provider Persistence

This Metasploit module establishes persistence by registering a malicious Time Provider DLL under HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders. When the W32Time service starts or restarts, the configured payload DLL is executed...

Malicious code in ezfnfix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a5bd6bf9cde5f28e20365db24b77ca15226b5248a3be482e30c45d98259b301 On Windows, npm install ezfnfix automatically executes a bundled Windows PE binary via a postinstall hook. package.json declares scripts.postinstall ...

MAL-2026-13344 Malicious code in ezfnfix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a5bd6bf9cde5f28e20365db24b77ca15226b5248a3be482e30c45d98259b301 On Windows, npm install ezfnfix automatically executes a bundled Windows PE binary via a postinstall hook. package.json declares scripts.postinstall ...

no-gdid — Updated!

no-gdid Read, understand, and silence the Windows Global Device Identifier GDID — the hidden per-account device ID that helped the FBI locate a suspect who was using a VPN. ⚠️ Honest disclaimer up front: this tool does not erase your GDID and does not make you anonymous. The GDID lives on...

Photo ZIP campaign targeting hospitality industry delivers Node.js implant for persistent access

In this article 1. Attack chain overview 2. Mitigation and protection guidance 3. References 4. Learn more Microsoft Threat Intelligence has identified an active multi-stage intrusion campaign targeting organizations in the hospitality and hotel industry since April 2026. We’ve observed this...

Malicious code in clobprice.api (npm)

A campaign of npm packages sharing a common dropper clob.js that downloads and persistently installs a Windows executable from IPFS on postinstall. The dropper fetches the binary from IPFS CID bafybeif3zkapj364ofnrvbty7oj5h5ufpxlp4s62usk3ulxrru35e3gssa via multiple public gateways Pinata,...

Malicious code in clob.api (npm)

A campaign of npm packages sharing a common dropper clob.js that downloads and persistently installs a Windows executable from IPFS on postinstall. The dropper fetches the binary from IPFS CID bafybeif3zkapj364ofnrvbty7oj5h5ufpxlp4s62usk3ulxrru35e3gssa via multiple public gateways Pinata,...

Malicious code in @devcarron/clob (npm)

A campaign of npm packages sharing a common dropper clob.js that downloads and persistently installs a Windows executable from IPFS on postinstall. The dropper fetches the binary from IPFS CID bafybeif3zkapj364ofnrvbty7oj5h5ufpxlp4s62usk3ulxrru35e3gssa via multiple public gateways Pinata,...

Dust Specter Targets Iraqi Officials with New SPLITDROP and GHOSTFORM Malware

A suspected Iran-nexus threat actor has been attributed to a campaign targeting government officials in Iraq by impersonating the country's Ministry of Foreign Affairs to deliver a set of never-before-seen malware. Zscaler ThreatLabz, which observed the activity in January 2026, is tracking the...

MAL-2026-811 Malicious code in grokwrapper (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a7ae896464be7f195243e35231a2435d0a1eb055cc7fa8cfaef707c7e11c55b2 During importing the module, package silently execute code hidden in an embedded config file, and downloads remote executable. It's then added to Run registry...