PythonMemoryModule

PythonMemoryModule pure-python implementation of MemoryModule technique to load a dll or unmanaged exe entirely from memory "Python memory module" AI generated pic - hotpot.ai What is it PythonMemoryModule is a Python ctypes porting of the MemoryModule technique originally published by Joachim...

BlackHole

BlackHole RAT C Herramienta de Administración Remota Solo con fines educativos Tecnologías protobuf-net : serialización/deserialización de mensajes en el protocolo esclavomaestro NetMQ : biblioteca de red utilizada para el sistema esclavomaestro clienteservidor Lz4.Net : biblioteca de compresión...

FilelessPELoader

FilelessPELoader Carica un PE remoto crittografato AES in memoria, lo decritta e lo esegue Utilizzo : Riferimenti : https://github.com/aplyc1a/PEMemoryLoader?fbclid=IwAR2-VAQo8pJU-tdbSENjhDBdDGi5tyzrnW1S3D9BPAYR6C6-RK4hsEDjDGk Requisiti 1. hashlib 2. pycryptodome 3. pycryptodomex...

ELFLoader

ELFLoader Este é um carregador/executor de objetos ELF em memória. O objetivo é criar um único carregador de ELF que possa ser usado para executar capacidades subsequentes em todos os sistemas operacionais x8664 e x86 nix. Como funciona A maneira como este carregador funciona é que ele contém tod...

dyen

dyen dyen carica una dylib Mach-O in memoria usando la Python stock di macOS e chiama un entry point esportato senza dlopen su quella dylib. L'obiettivo è che l'immagine non sia mai un file standalone sul target e non venga mai registrata con dyld. di cenobyte [email protected] 2026...

Hackers Found Using CrossC2 to Expand Cobalt Strike Beacon's Reach to Linux and macOS

Japan's CERT coordination center JPCERT/CC on Thursday revealed it observed incidents that involved the use of a command-and-control C2 framework called CrossC2, which is designed to extend the functionality of Cobalt Strike to other platforms like Linux and Apple macOS for cross-platform system...

Whispers of Atlantida: Safeguarding Your Digital Treasure

Recently, Rapid7 observed a new stealer named Atlantida. The stealer tricks users to download a malicious file from a compromised website, and uses several evasion techniques such as reflective loading and injection before the stealer is loaded. Atlantida steals a wide range of login information ...

Detecting reflective DLL loading with Windows Defender ATP

Today's attacks put emphasis on leaving little, if any, forensic evidence to maintain stealth and achieve persistence. Attackers use methods that allow exploits to stay resident within an exploited process or migrate to a long-lived process without ever creating or relying on a file on disk. In...

Empire: a PowerShell post-exploitation Agent tools-vulnerability warning-the black bar safety net

Empire is a purely PowerShell post-exploitation Agent tools, it is built on cryptography, secure communications and flexible architecture. Empire realize the need to powershell. exe you can run a PowerShell proxy function. Rapid deployment post-exploit module, from the keyboard recorder to...