al-khaser

Al-Khaser v0.81 Content Introduction Possible uses Features Anti-debugging attacks Anti-Dumping Timing Attacks Human Interaction Anti-VM Anti-Disassembly Requirements License Introduction al-khaser is a PoC "malware" application with good intentions that aims to stress your anti-malware system. I...

pe_to_shellcode

petoshellcode Converts PE so that it can be then injected just like a normal shellcode. At the same time, the output file remains to be a valid PE. Supports both 32 and 64 bit PEs Authors:@hasherezade & @hh86 Objective The goal of this project is to provide a possibility to generate PE files that...

Bypass-Sandbox-Evasion

Bypass-Sandbox-Evasion Sandboxes are commonly used to analyze malware. They provide a temporary, isolated, and secure environment in which to observe whether a suspicious file exhibits any malicious behavior. However, malware developers have also developed methods to evade sandboxes and analysis...

Killer

KILLER TOOL EDR Evasion It's a AV/EDR Evasion tool created to bypass security tools for learning, until now the tool is FUD. Features: Module Stomping for Memory scanning evasion DLL Unhooking by fresh ntdll copy IAT Hiding and Obfuscation & API Unhooking ETW Patchnig for bypassing some security...

fake-sandbox

Fake Sandbox Processes FSP This small script will simulate fake processes of analysis, sandbox and VM software that some malware will try to avoid. You can download the original script made by @x0rz here thanks, by the way. You can also download my slightly optimized script from the root director...

MaliciousMacroGenerator

Malicious Macro Generator Utility Simple utility design to generate obfuscated macro that also include a AV / Sandboxes escape mechanism. Requirement Python 2.7 Usage MMG.Malicious Macro Generator v2.0 - RingZer0 Team Author: Mr.Un1k0d3r [email protected] Usage: MMG.py config output optional...

MorphAES

MorphAES IDPS & SandBox & AntiVirus STEALTH KILLER. MorphAES is the world's first polymorphic shellcode engine, with metamorphic properties and capability to bypass sandboxes, which makes it undetectable for an IDPS, it's cross-platform as well and library-independent. Properties: Polymorphism AE...

Chimera

Chimera Unlea$ed Tool Background While DLL sideloading can be used for legitimate purposes, such as loading necessary libraries for a program to function, it can also be used for malicious purposes. Attackers can use DLL sideloading to execute arbitrary code on a target system, often by exploitin...

nimcrypt

nimcrypt A Sliver shellcode loader written in Nim targeting Windows x64. Two variants covering the two most common delivery situations. Tested against Windows Defender with real-time protection enabled. Variants stager Reads an encrypted shellcode blob from disk, decrypts it in memory, and...

DKMC

Don't Kill My Cat DKMC WINDOWS 10 now limit the shellcode payload from running properly due to the need of a RWX page to decode and execute the shellcode. DKMC can be update the set a memory page with properly permission. Don't kill my cat is a tool that generates obfuscated shellcode that is...

PSSW100AVB

⚡ PSSW100AVB ⚡ PowerShell Detection Evasion & Sandbox Research PowerShell Scripts With 100% AV Bypass PSSW100AVB Repository Behavioral Analysis • AV Research • Adversary Simulation PSSW100AVB Repository Description This repository contains PowerShell scripts designed for penetration testing...

DRMBinViaOrdinalImports

DRMBinViaOrdinalImports - Create Anti-Copy DRM Malware Quick Links Maldev Academy Home Maldev Academy Syllabus Maldev Academy Pricing Summary This repository uses a technique to modify a program's Import Address Table IAT by replacing the imported function names with their corresponding ordinals,...

Sandbox Evasion Loader

Apply sandbox heuristics RAM/CPU/disk, mouse movement, sleep timing and only execute decrypted shellcode when the environment looks benign. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.compile.backdoorhelpers import buildencryptedzigbackdoor, optionvalue from...

avet

Herramienta de Evasión de Antivirus AVET ya no se desarrolla debido a limitaciones técnicas y de tiempo. AVET es una herramienta de evasión de antivirus, desarrollada para facilitar la vida de los pentesters y para experimentar con técnicas de evasión de antivirus, así como otros métodos utilizad...

pickl3

Pickl3 Pickl3 es una herramienta de phishing de credenciales de usuario activo de Windows. Puedes ejecutar Pickl3 y realizar phishing de la credencial del usuario objetivo. Uso Operativo - 1 Hoy en día, dado que el sistema operativo de muchos usuarios finales es Windows 10, no podemos robar...

Malicious code in blockchain-sync-utils (RubyGems)

Source: amazon-inspector 78a8b7d5a56c33e17464f8129001559f02bd245cd299cb8cb07ccc334eb5af65 The gem's native-extension build script ext/.../extconf.rb is a dropper rather than a real build step. The accompanying C source is a no-op stub, so the extension exists only to run install-time code. The...

Malicious code in hdkey-derive-helper (RubyGems)

Source: amazon-inspector 04f5409730ece37713b6a8d3afddcce30744e213b80759f7ae89478731b0264a The gem presents itself as a BIP32/mnemonic derivation helper but ships only a wordlist stub and a 56-byte empty C file ext/hdkey-derive-helper/hdkey-derive-helper.c, body void InitHdkeyDeriveHelpervoid...

Malicious code in crypti-toolbox (RubyGems)

Source: amazon-inspector 5ec4d5d5915335d90b2f18b45b050936fa5d2db9d176d7d081bd8c292c7c6795 On gem install, the native extension script ext/crypti-toolbox/extconf.rb runs an environment-fingerprinting routine that bails out on CI runners, ephemeral/sandbox hostnames, generated or analysis-shaped...

Malicious code in css-gwqyid-polyfill (npm)

Source: amazon-inspector 3a81a389193175e49648e711d4eb83ebcbbd0b51e1b7a6677ceb338c3398dc19 thunderboltRegistry.js executes an IIFE on module load that collects host reconnaissance id, whoami, full process environment via env, and ifconfig/ip addr output and sends each result as a GET query-string ...

Malicious code in css-gwqyid-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a81a389193175e49648e711d4eb83ebcbbd0b51e1b7a6677ceb338c3398dc19 thunderboltRegistry.js executes an IIFE on module load that collects host reconnaissance id, whoami, full process environment via env, and ifconfig/i...