AntiVE-BehaviorWatch

AntiVE-BehaviorWatch Embedded AI-powered human behavior verification for cybersecurity research. What is AntiVE-BehaviorWatch? AntiVE-BehaviorWatch is a Windows-based cybersecurity research project that explores a new approach to execution control using embedded artificial intelligence. Instead o...

Nodejs-Tracer

nodejs-tracer Simple Node.jstracer that logs calls to core modules, can spoof certain calls to defeat anti-analysis, save files written by the application and more. Useful to analyze heavily obfuscated Node.js malware. Usage root@kitploit: node -r .\tracer.js main.js Example trace with DISPLAYSTA...

px-vm

PerimeterX Auditor VM Analysis Summary This repository documents the reverse engineering of PerimeterX's auditor.js, a bytecode virtual machine used as a secondary fingerprinting layer in PX's bot detection pipeline. This analysis covers: Bytecode extraction and 5-layer decryption pipeline Opcode...

VBoxCloak

VBoxCloak A PowerShell script that attempts to help malware analysts hide their VirtualBox Windows VM's from malware that may be trying to evade analysis. Guaranteed to bring down your pafish ratings by at least a few points ; The script accomplishes this by doing the following: Renames several...

RustyWater-ShellCode-Dropper

RustyWater ShellCode Dropper RustyWater represents the main payload and the backbone of the entire adversarial operation in Static Kitten group attacks. RustyWater is a Rust compiled executable disguised as reddit.exe with a fake Cloudflare icon known as RustyWater or linked to Archer RAT/RUSTRIC...

Shortcut-Payload-Generator

Shortcut-Payload-Generator Exploiting Powershell to make ShortCut Payloads fud. There is too much of awsome tricks there , u can make it better ^^. For Ex : Killing tcpview , taskmanager ..etc while downloading. Set hidden attribs to the malware after downloading....etc G00d by3. ./9aylas EOF...

Uchihash

Uchihash Uchihash is a small tool that can save malware analysts the time of dealing with embedded hash values used for various things such as: Dynamically importing APIs especially in shellcode Checking running process used by analysts Anti-Analysis Checking VM or Antivirus artifacts Anti-Analys...

engine

Droidefense Engine 고급 Android 악성코드 분석 프레임워크 최신 릴리스 다운로드 Droidefense란? Droidefense 원래 이름은 atom: a nalysis t hrough o bservation m achine는 Android 앱/악성코드 분석/리버싱 도구의 코드명입니다. 이 도구는 악성코드 연구원들이 일상 업무에서 직면하는 보안 문제와 트릭에 중점을 두고 구축되었습니다. 악성코드에 안티 분석 루틴이 있는 상황에서 Droidefense는 이를 우회하여 코드와 'bad boy' 루틴에 접근하려고...

engine

Droidefense Engine Advance Android Malware Analysis Framework Latest release Download What Droidefense is Droidefense originally named atom: a nalysis t hrough o bservation m achine is the codename for android apps/malware analysis/reversing tool. It was built focused on security issues and trick...

invoke-antivm

Invoke-AntiVM v1.0 소개 Invoke-AntiVM은 PowerShell을 통해 VM 탐지 및 핑거프린팅데이터 유출 포함을 수행하는 모듈 집합입니다. 호환성 check-compatibility.ps1 스크립트를 실행하여 PowerShell 버전과 호환되는 모듈 또는 함수를 확인하십시오. 목표는 2.0부터 호환을 달성하는 것이지만 아직 거기에 도달하지 못했습니다. 현재 호환성 문제를 확인하려면 check-compability.ps1을 실행하십시오. 배경 이 도구는 VM 또는 샌드박스 기술을 식별하기 위한 여러 기법을...

pafish

Pafish Pafish는 여러 기법을 사용하여 가상 머신 및 악성코드 분석 환경을 탐지하는 테스트 도구로, 악성코드 패밀리와 동일한 방식으로 동작합니다. 이 프로젝트는 무료 오픈 소스이며, 모든 안티-분석 기법의 코드는 공개적으로 제공됩니다. Windowsx86 32비트 및 64비트용 Pafish 실행 파일은 릴리스 페이지에서 다운로드할 수 있습니다. 범위 이 프로젝트의 목표는 악성코드 샘플에서 일반적으로 관찰되는 분석 시스템 회피 기법을 수집하는 것입니다. 이를 통해 분석가들은 해당 기법을 연구하고 분석 환경이 적절히...

pafish

Pafish Pafish is a testing tool that uses different techniques to detect virtual machines and malware analysis environments in the same way that malware families do. The project is free and open source; the code of all the anti-analysis techniques is publicly available. Pafish executables for...

MAL-2026-13738 Malicious code in @openzeppelin-5/contracts (npm)

@openzeppelin-5/contracts is a malicious npm package published by npm account mssjeep843 that impersonates OpenZeppelin's @openzeppelin/contracts the v5 line via the look-alike scope @openzeppelin-5, falsely describing itself as a "compatibility distribution". It ships no Solidity contracts — onl...

Malicious code in @openzeppelin-5/contracts (npm)

@openzeppelin-5/contracts is a malicious npm package published by npm account mssjeep843 that impersonates OpenZeppelin's @openzeppelin/contracts the v5 line via the look-alike scope @openzeppelin-5, falsely describing itself as a "compatibility distribution". It ships no Solidity contracts — onl...

MAL-2026-13360 Malicious code in uzair-rajput-new (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b371d3a1e96e6e79066cf8f620a85867c73eb9ddbe68a81a33589e85146c4df6 The package is published as a chalk/tinygradient color-gradient wrapper, and its ESM entrypoint dist/index.js matches that description. The CJS main...

Malicious code in dolyame-boxy-desktop-bnpl-card-panel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5b6f75040edc2a67f6c4912c7b8ff63ec6bd8dbd35c235bd3787ea24f52d4a2 On require/import, index.js loads./polyfill.js which selects a platform-specific endpoint, fetches bytes over HTTPS from one of several .workers.dev...

Malicious code in bigops-timeline-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a6a5b474ef344ddb8aa478f73099e3644817aa8a87199eaa3c46f03d27baa13 On require of bigops-timeline-ui, index.js loads./adapter.js which fetches a platform-specific binary from Cloudflare Workers hosts whose names are...

Malicious code in bigops-watchdog-worker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a65df39f269239434211427140c77c096d41d8de8800667ef39a27bf89572c67 On require of bigops-watchdog-worker, index.js loads runtime.js which reconstructs remote hostnames from split-string fragments e.g. joining...

MAL-2026-12856 Malicious code in bigops-watchdog-worker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a65df39f269239434211427140c77c096d41d8de8800667ef39a27bf89572c67 On require of bigops-watchdog-worker, index.js loads runtime.js which reconstructs remote hostnames from split-string fragments e.g. joining...

Malicious code in @wololasod/tiny-id (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b3ca8617b237bb3d8fd7d14aa18554118397e7b7faaea2e87cdd8433fef7a8f The package advertises itself as a tiny ID generator but its main entry dist/index.cjs contains an obfuscator.io + RC4 string-array VM that, on...