pe_to_shellcode

petoshellcode Converts PE so that it can be then injected just like a normal shellcode. At the same time, the output file remains to be a valid PE. Supports both 32 and 64 bit PEs Authors:@hasherezade & @hh86 Objective The goal of this project is to provide a possibility to generate PE files that...

Bypass-Sandbox-Evasion

Bypass-Sandbox-Evasion Sandboxes are commonly used to analyze malware. They provide a temporary, isolated, and secure environment in which to observe whether a suspicious file exhibits any malicious behavior. However, malware developers have also developed methods to evade sandboxes and analysis...

fake-sandbox

Fake Sandbox Processes FSP This small script will simulate fake processes of analysis, sandbox and VM software that some malware will try to avoid. You can download the original script made by @x0rz here thanks, by the way. You can also download my slightly optimized script from the root director...

MorphAES

MorphAES IDPS & SandBox & AntiVirus STEALTH KILLER. MorphAES is the world's first polymorphic shellcode engine, with metamorphic properties and capability to bypass sandboxes, which makes it undetectable for an IDPS, it's cross-platform as well and library-independent. Properties: Polymorphism AE...

nimcrypt

nimcrypt A Sliver shellcode loader written in Nim targeting Windows x64. Two variants covering the two most common delivery situations. Tested against Windows Defender with real-time protection enabled. Variants stager Reads an encrypted shellcode blob from disk, decrypts it in memory, and...

Killer

KILLER TOOL EDR Evasion It's a AV/EDR Evasion tool created to bypass security tools for learning, until now the tool is FUD. Features: Module Stomping for Memory scanning evasion DLL Unhooking by fresh ntdll copy IAT Hiding and Obfuscation & API Unhooking ETW Patchnig for bypassing some security...

Chimera

Chimera Unlea$ed Tool Background While DLL sideloading can be used for legitimate purposes, such as loading necessary libraries for a program to function, it can also be used for malicious purposes. Attackers can use DLL sideloading to execute arbitrary code on a target system, often by exploitin...

al-khaser

Al-Khaser v0.81 Content Introduction Possible uses Features Anti-debugging attacks Anti-Dumping Timing Attacks Human Interaction Anti-VM Anti-Disassembly Requirements License Introduction al-khaser is a PoC "malware" application with good intentions that aims to stress your anti-malware system. I...

MaliciousMacroGenerator

Malicious Macro Generator Utility Simple utility design to generate obfuscated macro that also include a AV / Sandboxes escape mechanism. Requirement root@kitploit: Python 2.7 Usage root@kitploit: MMG.Malicious Macro Generator v2.0 - RingZer0 Team Author: Mr.Un1k0d3r [email protected] Usage:...

avet

反病毒逃避工具 AVET 因技术发展和时间限制不再继续开发。 AVET 是一款反病毒逃避工具，旨在让渗透测试人员的工作更轻松，并用于实验反病毒逃避技术以及恶意软件使用的其他方法。 关于 v2.4 的新功能以及过往版本更新的概览，请查看 CHANGELOG 文件。 目录 安装 Docker AVET 简易方式 AVET 常规方式 文档（ 点击展开 ） 数据检索方法 加密与编码 沙箱逃逸 附加命令执行 辅助工具 AVET 与 Metasploit psexec 对抗样本 更多 部分特性 当运行由 msfpayload 等工具生成的 .exe 文件时，该文件通常会被杀毒软件识别 AVET...

PSSW100AVB

⚡ PSSW100AVB ⚡ Evasión de detección de PowerShell e investigación en sandbox Repositorio de scripts de PowerShell con 100% de bypass de AV PSSW100AVB...

MAL-2026-15933 Malicious code in houdus (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f1c6df3b6cf8e44eceecfcd1aa44ee0301e8921b0c5294560c0031c0b17b6e6 The package advertises random-number helpers but its generator.py side-loads houdus/assests/ssd.wav as Python via importlib.util.specfromfilelocation...

Malicious code in houdus (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f1c6df3b6cf8e44eceecfcd1aa44ee0301e8921b0c5294560c0031c0b17b6e6 The package advertises random-number helpers but its generator.py side-loads houdus/assests/ssd.wav as Python via importlib.util.specfromfilelocation...

debloat

Debloat Debloat es una herramienta GUI y CLI para eliminar la basura excesiva de ejecutables inflados. Con "basura excesiva" me refiero a 100 - 800 MB de bytes basura añadidos a un binario para evitar que entre en un sandbox. Este método de añadir basura se llama "inflar" o "bombear" un binario...

pickl3

Pickl3 Pickl3 是一款针对 Windows 活跃用户的凭证钓鱼工具。您可以执行 Pickl3 来钓取目标用户的凭证。 操作使用 - 1 如今，由于许多终端用户的操作系统是 Windows 10，我们无法像过去那样轻易地使用类似 Mimikatz 的项目窃取账户信息。使用 Pickl3，您可以尝试在无需提升权限的情况下窃取活跃用户的账户信息。 操作使用 - 2 如今，已知的沙箱检测方法大约有 200 种。沙箱，尤其是在虚拟机监控器层进行分析的沙箱，对这些检测方法具有免疫力。但沙箱在用户交互方面还不够好。通过在开发的恶意软件中使用...

DKMC

别杀我的猫 DKMC Windows 10 现在限制了 shellcode 载荷的正常运行，因为需要 RWX 页面来解码和执行 shellcode。DKMC 可以更新以设置具有适当权限的内存页面。 别杀我的猫是一款工具，它能生成存储在多重图像中的混淆 shellcode。该图像 100% 有效，同时也是 100% 有效的 shellcode。其思路是避免沙箱分析，因为它只是一张简单的“合法”图像。目前该工具依赖 PowerShell 来执行最终的 shellcode 载荷。 为什么叫“别杀我的猫”？因为我不擅长为工具起名，所以决定利用默认 BMP 图像是一只猫的事实来命名。...

DRMBinViaOrdinalImports

DRMBinViaOrdinalImports - Create Anti-Copy DRM Malware Quick Links Maldev Academy Home Maldev Academy Syllabus Maldev Academy Pricing Summary This repository uses a technique to modify a program's Import Address Table IAT by replacing the imported function names with their corresponding ordinals,...

Malicious code in syswatch (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 740c9125f18d68081f742b3316d07c54727fb4aab5555a398c0c04e31ba9bb54 Importing syswatch starts a background thread that, on Windows, fetches a JSON manifest from...

MAL-2026-15811 Malicious code in syswatch (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 740c9125f18d68081f742b3316d07c54727fb4aab5555a398c0c04e31ba9bb54 Importing syswatch starts a background thread that, on Windows, fetches a JSON manifest from...

Malicious code in secret-key-totp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f662164281fe877686c7eac93e0e6d068ccb16f8bff1b44029b1ace655a76b6 [email protected] declares a postinstall hook node./index.js --setup that executes a credential stealer and dropper on install, and the same...