⚠️ malware development

Golang library for malware development

Slides & Code snippets for a workshop held @ x33fcon 2024

Reflective DLL Injection Made Bella

Swiss Army Knife for payload encryption, obfuscation, and conversion to byte arrays – all in a single command (14 output formats supported)! ☢️

Malleable shellcode loader written in C and Assembly utilizing direct or indirect syscalls for evading EDR hooks

In-memory hiding technique

Process Hollowing PoC

⚠️ Malware Development training ⚠️

Articles, White Papers, Technical Write-Ups and more authored by members of the GreySec community. Curated by staff, selected for excellence.

Generate Secure, Polymorphic, Evasive Payloads

go-native-syscall is Go (+ asm) Windows syscall library that resolves, hashes, caches, and invokes direct (and indirect now) NT calls without going through the win api layer traditionally

XMRig Service Installer: An automation tool to swiftly set up the xmrig mining software as a background service on Windows. Designed for educational and research purposes, it streamlines the miner's installation and offers an easy way to run xmrig on-demand.

This is a tool for obfuscating functions in C/C++ programs on Windows. It hides what a function does by changing its code while the program is running, moves that code to another place in memory, and uses Windows exception handling to jump to the moved code when the function is called.

A cryptographic payload loader and executor designed for advanced in-memory execution techniques. This project combines strong encryption, compression, and sophisticated evasion capabilities to execute both shellcode and PE files directly in memory.

ECX and eMLR Malware research, Studying mydoom Malware EXECUTION

A lightweight, fast, and powerful remote administration tool written in C#. Whether you're providing user support, handling daily admin tasks, or monitoring employees, Pulsar offers high stability and an intuitive interface—making it your go-to solution for remote administration.

Shellcode loader/injector generator

another pe/dll/shellcode loader that downloads and executes files from urls in memory

Collections d'attaques et de codes produit pour entrainement a des scénarios de redteams