SharpHide

SharpHide Just a nice persistence trick to confuse DFIR investigation. Uses NtSetValueKey native API to create a hidden null terminated registry key. This works by adding a null byte in front of the UNICODESTRING key valuename. More info about this technique can be found in the following...

Palsy-Virus

Palsy Virus Python virus that will make your pc paralyzed once it opened ,hides itself and adds itself to the registry startup ^^ Platform : -- Windows only :P...

RustyWater-ShellCode-Dropper

RustyWater ShellCode Dropper RustyWater represents the main payload and the backbone of the entire adversarial operation in Static Kitten group attacks. RustyWater is a Rust compiled executable disguised as reddit.exe with a fake Cloudflare icon known as RustyWater or linked to Archer RAT/RUSTRIC...

-Remcos-RAT-Fileless-svchost-Injection-Obfuscated-Payload-Analysis-

1. Remcos – svchost Injection via Native API Calls The following Binary Ninja snippet reveals the core injection mechanism used by Remcos to inject its payload into svchost.exe. What This Code Does: CreateProcessW with the CREATESUSPENDED flag starts a new svchost process in a suspended state...

spybrowse

BrowseSpy コード全体のFTP変数を必ず変更してください。これらの変数には、ファイルを受信するFTPサーバーのユーザー名、パスワード、IPアドレスが含まれています。 このコードは以下の処理を行います。 1. 自身を%TMP%ディレクトリにコピーし、ursakta.exeという名前を付けます。 2. ユーザーがログインするたびに自身を実行するレジストリエントリを追加します。 3. ユーザーが使用しているブラウザ（Chrome、Firefox、Brave）を確認します。 4. Chrome、Firefox、またはBraveのブラウザディレクトリ内のファイルを検索します。 5...

Shell3er

Shell3er Shell3er PowerShell 리버스 쉘 Shell3er 리버스 기능 Get-RandomProcessName 함수 Get-RandomProcessName 함수는 "PS"와 새 GUID를 연결하여 임의의 프로세스 이름을 생성합니다. 이는 고유하고 무작위로 보이는 프로세스 이름을 만들어 의심스러운 프로세스를 식별하기 어렵게 하는 데 사용됩니다. Run-BackgroundTask 함수 Run-BackgroundTask 함수는 ScriptBlock과 선택적 ProcessName을 매개변수로 받습니다. 그런 다음...

BOF_Collection

BOFCollection さまざまな Cobalt Strike BOF 必要条件 beacon.h コンパイル手順とBOFの概要については、help-bof を参照してください。 ActiveDirectory GetDomainInfo.c 現在のドメインとドメインコントローラーに関する情報を返します。 inline-execute GetDomainInfo.o Collection GetClipboard.c クリップボード上のテキストを表示します。 inline-execute GetClipboard.o dumpwifi.c...

CVE-2026-3502-Scanner---TrueConf-Vulnerability-Detection-Tool

🔍 CVE-2026-3502 スキャナー - TrueConf 脆弱性検出ツール ⚠️ 警告 教育目的および許可されたテストのみを対象としています。 📋 説明 CVE-2026-3502 用の検出ツールです。更新確認なしで TrueConf サーバーをスキャンし、脆弱な Windows クライアント（≤8.5.3.884）を検出し、TrueChaos の IOC（PowerISO、レジストリの永続化、スケジュールされたタスク）を検索します。 📦 インストール git clone https://github.com/tu-usuario/CVE-2026-3502-Scanner.git...

Photo ZIP campaign targeting hospitality industry delivers Node.js implant for persistent access

In this article 1. Attack chain overview 2. Mitigation and protection guidance 3. References 4. Learn more Microsoft Threat Intelligence has identified an active multi-stage intrusion campaign targeting organizations in the hospitality and hotel industry since April 2026. We’ve observed this...

Malicious code in clobprice.api (npm)

A campaign of npm packages sharing a common dropper clob.js that downloads and persistently installs a Windows executable from IPFS on postinstall. The dropper fetches the binary from IPFS CID bafybeif3zkapj364ofnrvbty7oj5h5ufpxlp4s62usk3ulxrru35e3gssa via multiple public gateways Pinata,...

Malicious code in clob.api (npm)

A campaign of npm packages sharing a common dropper clob.js that downloads and persistently installs a Windows executable from IPFS on postinstall. The dropper fetches the binary from IPFS CID bafybeif3zkapj364ofnrvbty7oj5h5ufpxlp4s62usk3ulxrru35e3gssa via multiple public gateways Pinata,...

Malicious code in @devcarron/clob (npm)

A campaign of npm packages sharing a common dropper clob.js that downloads and persistently installs a Windows executable from IPFS on postinstall. The dropper fetches the binary from IPFS CID bafybeif3zkapj364ofnrvbty7oj5h5ufpxlp4s62usk3ulxrru35e3gssa via multiple public gateways Pinata,...

Dust Specter Targets Iraqi Officials with New SPLITDROP and GHOSTFORM Malware

A suspected Iran-nexus threat actor has been attributed to a campaign targeting government officials in Iraq by impersonating the country's Ministry of Foreign Affairs to deliver a set of never-before-seen malware. Zscaler ThreatLabz, which observed the activity in January 2026, is tracking the...

MAL-2026-811 Malicious code in grokwrapper (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a7ae896464be7f195243e35231a2435d0a1eb055cc7fa8cfaef707c7e11c55b2 During importing the module, package silently execute code hidden in an embedded config file, and downloads remote executable. It's then added to Run registry...

Russian APT28 Deploys "NotDoor" Outlook Backdoor Against Companies in NATO Countries

The Russian state-sponsored hacking group tracked as APT28 has been attributed to a new Microsoft Outlook backdoor called NotDoor in attacks targeting multiple companies from different sectors in NATO member countries. NotDoor "is a VBA macro for Outlook designed to monitor incoming emails for a...

Malicious Package

Overview colorinal is a malicious package. This package is part of a multi-stage attack and its content was removed from the official package manager. The attack utilizes a seemingly harmless package to introduce a malicious dependency. The goal of this attack is to gain remote code execution on...

Malicious Package

Overview termncolor is a malicious package. This package is part of a multi-stage attack and its content was removed from the official package manager. The attack utilizes a seemingly harmless package to introduce a malicious dependency. The goal of this attack is to gain remote code execution on...

Malicious code in planweb-core-ui (npm)

This package contains code to download a second stage payload which establishes a C2 connection and persistence via registry keys. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware acc967a53ff92a71f6b9518c692bf641aa3595a3b65f28cc403b471c0474b175 Any computer that has...

MULTI#STORM Campaign Targets India and U.S. with Remote Access Trojans

A new phishing campaign codenamed MULTISTORM has set its sights on India and the U.S. by leveraging JavaScript files to deliver remote access trojans on compromised systems. "The attack chain ends with the victim machine infected with multiple unique RAT remote access trojan malware instances, su...

LOBSHOT: A Stealthy, Financial Trojan and Info Stealer Delivered through Google Ads

In yet another instance of how threat actors are abusing Google Ads to serve malware, a threat actor has been observed leveraging the technique to deliver a new Windows-based financial trojan and information stealer called LOBSHOT. "LOBSHOT continues to collect victims while staying under the...