AntiDbg-Unabomber

Unabomber فكرة محسّنة لـ VMP AmogusPlugin القديم...

ddoor

ddoor cross platform backdoor using dns txt records What is ddor? ddor is a cross platform light weight backdoor that uses txt records to execute commands on infected machines. Features Allows a single txt record to have seperate commands for both linux and windows machines List of around 10 publ...

postshell

PostShell PostShell ist eine Post-Exploitation-Shell, die sowohl eine Bind-Shell als auch eine Back-Connect-Shell umfasst. Sie erstellt ein vollständig interaktives TTY, das Job Control ermöglicht. Die Stub-Größe beträgt etwa 14 KB und kann auf jedem Unix-ähnlichen System kompiliert werden...

recaptcha

विवरण इस रिपॉज़िटरी में Google के एंटीबॉट reCAPTCHA का तकनीकी विश्लेषण है, जो निम्न पर केंद्रित है: पेलोड संरचना और मान फ़िंगरप्रिंटिंग तकनीकें ऑबफस्केशन तकनीकें एंटी-डीबगिंग/टैम्परिंग तकनीकें वर्चुअल मशीनें संपर्क Discord: @grecaptcha Telegram: @lyxlobyx ऑबफस्केशन तकनीकें reCAPTCHA उन एंटी-बॉट...

peframe

peframe peframe è uno strumento open source per eseguire analisi statiche su malware Portable Executable e file sospetti generici. Può aiutare i ricercatori di malware a rilevare packer, xor, firma digitale, mutex, anti debug, anti macchina virtuale, sezioni e funzioni sospette, macro e molte alt...

makin

I create makin to make initial malware assessment little bit easier for me, I think it's useful for others as well, It helps to reveal a debugger detection techniques used by a sample. Any feedback is greatly appreciated: @qazqaz How does it work? makin opens a sample as a debuggee and injects...

al-khaser

Al-Khaser v0.81 Contenuti Introduzione Possibili usi Funzionalità Attacchi anti-debug Anti-Dumping Attacchi temporali Interazione umana Anti-VM Anti-Disassemblaggio Requisiti Licenza Introduzione al-khaser è un'applicazione PoC "malware" con buone intenzioni che mira a stressare il tuo sistema...

0xGUARD

📄 Funktionen Modul-Remapping Thread-Filterung Modul-Ausblendung Speicherprüfung Integritätsprüfung Anti-DLL-Injection Anti-Debugging Prozessrichtlinie Literal-String-Verschleierung Kompatibilität mit Themida/VMProtect ✔️ Abhängigkeiten Windows 711 Visual Studio 2019 🔧 Verwendung 1. Legen Sie die...

ASM-Obfuscator

ASM-Obfuscator Fortgeschrittener x86-64-Assembly-Obfuskator. Beschreibung Der Assembly-Code-Obfuskator ist ein leistungsstarkes und vielseitiges Werkzeug, das entwickelt wurde, um die Sicherheit Ihres x86-64-Assembly-Codes zu erhöhen. Es schützt Ihre Projekte vor Reverse Engineering und Analyse,...

postshell

PostShell PostShell is a post-exploitation shell that includes both a bind and a back connect shell. It creates a fully interactive TTY which allows for job control. The stub size is around 14kb and can be compiled on any Unix like system. ScreenShots Banner and interaction with shell after a...

azazel

Azazel V 0.1 The whole earth has been corrupted through the works that were taught by Azazel: to him ascribe all sin. -- 1 Enoch 2:8 Azazel is a userland rootkit based off of the original LDPRELOAD technique from Jynx rootkit. It is more robust and has additional features, and focuses heavily...

Webmin_Exploit_reverse_shell

Introdução: O Webmin Exploit é um exploit direcionado para o serviço Webmin, que pode ser explorado em versões mais antigas do Webmin. Este exploit usa várias técnicas para executar código malicioso e obter acesso não autorizado ao sistema alvo. Isso envolve: Usar código C e Assembly para executa...

widevine-l3-decryptor

Deprecation Warning This repository used to contain code to circumvent Widevine L3 DRM in Chrome on Windows machines. It's not working anymore as of May 31st 2021, but you can read the reversing writeup. Update Google issued a DMCA takedown request against most forks of this repository. The...

MAL-2026-10743 Malicious code in nordpass (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9df6f21fababcd99ba522d380a0729d35aa4ff44ee2f6612fe75b906da844aee Package name impersonates the NordPass password-manager product while presenting itself as 'A simple authentication module.' The package.json...

Malicious code in @nullzero/urlcat (npm)

@nullzero/urlcat version 1.4.2, published by [email protected] is a trojanized npm package belonging to the wshu.net credential-stealer campaign. The campaign published trojanized look-alike utility packages across 12+ scopes whose publisher accounts all follow the pattern [email protected], with...

Malicious code in jailbreak-code (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f729dde017c78154685be850893a9f3ebd58bf0b5cb1229e7e49fb09b14f5d5 The package presents itself as an AI developer CLI but is engineered as a credential and payment harvester. src/c2.ts hardcodes a Discord webhook URL...

MAL-2026-5543 Malicious code in jailbreak-code (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f729dde017c78154685be850893a9f3ebd58bf0b5cb1229e7e49fb09b14f5d5 The package presents itself as an AI developer CLI but is engineered as a credential and payment harvester. src/c2.ts hardcodes a Discord webhook URL...

TLSCheck 2.0: An Enhanced Memory Forensics Approach to Efficiently Detect TLS Callbacks

Memory analysis is a crucial technique in digital forensics that enables investigators to examine the runtime state of a system through physical memory dumps. While significant advances have been made in memory forensics, the detection and analysis of Thread Local Storage TLS callbacks remain...

Advanced Python Payload Encryption Framework with Hybrid Cryptography Steganography and Anti‑Debugging

This Python program implements an advanced payload protection framework that combines multiple security and obfuscation techniques to encrypt, package, and distribute Python code. The framework supports hybrid encryption, multi‑key protection, anti‑debugging checks, and optional steganographic...

charlotte

This is a C++ shellcode launcher, fully undetected as of May 13th, 2021. It dynamically invokes Windows API functions, XOR encrypts shellcode and function names, and uses random XOR keys and variables per run. The code is designed to be stealthy and evade detection. The code is written in C++ and...