VortexCry-Ransomware-Release

VortexCry-Ransomware VortexCry is an advanced ransomware that utilizes multi-stage process injection such as Process Hollowing and APC Injection and kernel driver loading via the CVE-2019-16098 vulnerability. It is capable of encrypting files, destroying system recovery functionalities, and...

Sharperner

Sharperner Sharperner is a tool written in CSharp that generate .NET dropper with AES and XOR obfuscated shellcode. Generated executable can possibly bypass signature check but I cant be sure it can bypass heuristic scanning. Features PE binary Process Hollowing PPID Spoofing Random generated AES...

PELoader

PELoader PELoader implement various shellcode injection techniques, and use libpeconv library to load encrypted PE files instead of injecting shellcode into remote thread. Following techniques were implemented: Module Stomping LoadLibrary Module Stomping NtMapViewOfSection PoC Transacted Hollowin...

Ares

Project Ares Project Ares Injector Project Ares Injector is a Proof of Concept PoC loader written in C/C++ based on the Transacted Hollowing technique. The loader injects a PE into a remote process and features: PPID spoofing CIG to block non-Microsoft-signed binaries Dynamic function resolution...

ghost

Ghost Ghost is a process injection detection tool written in Rust. It watches running processes and tries to catch suspicious stuff like code injection, memory manipulation, and other tricks that malware uses to hide. What it does The main idea is simple: scan processes and look for weird memory...

ZeroCrumb

ZeroCrumb Dumping App Bound Protected Credentials & Cookies Without Privileges. Explanation ZeroCrumb bypasses the Chrome Elevation Service by impersonating a Chrome instance using Transacted Hollowing, Effectively allowing us to use the IElevator COM interface to decrypt the App Bound Key. Then,...

hollows_hunter

hollowshunter Hollows Hunter is a command-line application based on PE-sieve passive memory scanner. Recognizes and dumps a variety of potentially malicious implants replaced/implanted PEs, shellcodes, hooks, in-memory patches. While in case of PE-sieve you can select the process only by its PID,...

PichichiH0ll0wer

PichichiH0ll0wer PichichiH0ll0wer About Features Injection methods Installation Usage Credits About --== Process hollowing loader written in Nim for PEs only ==-- I built PichichiH0ll0wer to learn and contribute, sure. but also because I'm quite tired of shellcodes everywhere. Loading PEs might b...

SharpBlock

SharpBlock A method of bypassing EDR's active projection DLL's by preventing entry point execution. Features Blocks EDR DLL entry point execution, which prevents EDR hooks from being placed. Patchless AMSI bypass that is undetectable from scanners looking for Amsi.dll code patches at runtime. Hos...

memhunter

Memhunter Automated hunting of memory resident malware at scale This project is WORK IN PROGRESS. Expect feature changes and binary releases on the upcoming weeks. Overview Memhunter is an endpoint sensor tool that is specialized in detecing resident malware, improving the threat hunter analysis...

ProcessInjection

ProcessInjection Программа предназначена для выполнения внедрения процессов. В настоящее время инструмент поддерживает 5 техник внедрения процессов. 1 Vanilla Process Injection 2 DLL Injection 3 Process Hollowing 4 APC Queue 5 KernelCallbackTable Injection Инструмент принимает shellcode в 4...

Chrome-App-Bound-Encryption-Decryption

ChromElevator Chrome App-Bound Encryption Decryption 🚀 Overview Постэксплуатационный инструмент, демонстрирующий полный обход App-Bound Encryption ABE в Chromium, выполняемый полностью в памяти. Проект использует Direct Syscall-based Reflective Process Hollowing для запуска легитимного процесса...

pe-sieve

Introduction PE-sieve est un outil qui aide à détecter les malwares en cours d'exécution sur le système, ainsi qu'à collecter le matériel potentiellement malveillant pour une analyse plus approfondie. Il reconnaît et vide une variété d'implants dans le processus scanné : PE remplacés/injectés,...

hollows_hunter

hollowshunter Hollows Hunter est une application en ligne de commande basée sur le scanneur mémoire passif PE-sieve. Il reconnaît et extrait une variété d'implants potentiellement malveillants PE remplacés/implantés, shellcodes, hooks, correctifs en mémoire. Alors qu'avec PE-sieve vous ne pouvez...

GhostlyHollowingViaTamperedSyscalls2

Ghostly Hollowing через Tampered Syscalls Уведомление о повторной загрузке !NOTE Изначально в репозитории использовалась некорректная лицензия, в которой отсутствовала ссылка на основателя DeceptIQ, @Rad9800, чей репозиторий TamperingSyscalls опубликован под лицензией MIT. Его работа уже была...

avet

Outil d'évasion antivirus AVET n'est plus développé en raison de l'évolution technique et des contraintes de temps. AVET est un outil d'évasion antivirus, développé pour faciliter la vie des testeurs d'intrusion et pour expérimenter les techniques d'évasion antivirus, ainsi que d'autres méthodes...

process_overwriting

Écrasement de processus L'écrasement de processus est une technique d'injection PE, étroitement liée au Process Hollowing et au Module Overloading. Elle permet de remplacer l'exécutable principal pas une DLL du processus cible. Elle fonctionne uniquement pour un processus nouvellement créé –...

Lumma-Stealer-dllhost-Hollowing-C2-Domains-Payload-Extraction-Analysis

1. Setup.exe – Конфиденциальность, драйверы и строки памяти Анализ памяти setup.exe дроппера с помощью Process Hacker показывает, что Lumma Stealer нацелен на настройки конфиденциальности, устанавливает драйверы и управляет памятью. Ключевые наблюдаемые строки: Privacy Camera – Попытка доступа к...

patriot

Patriot Небольшой исследовательский проект для обнаружения различных видов скрытых техник в памяти. Скачайте последний релиз здесь. Текущая версия поддерживает следующие обнаружения: Подозрительные структуры CONTEXT, указывающие на функции VirtualProtect. Нацелено на исследование Остина Хадсона...

StealC-Stealer-RuntimeBroker-Hollowing-C2-Extraction-Payload-Extraction-Analysis

1. RuntimeBroker.exe Hollowing & C2 IP Addresses Process Hacker memory analysis reveals that StealC Stealer performs process hollowing on RuntimeBroker.exe and establishes connections to multiple C2 servers. Key Observations: Target Process: RuntimeBroker.exe PID 14900. C2 IP Addresses:...