LightsOut will generate an obfuscated DLL that will disable AMSI & ETW while trying to evade AV. This is done …
Subparse – Modular Malware Analysis Artifact Collection And Correlation Framework
Subparse, is a modular framework developed by Josh Strochein, Aaron Baker, and Odin Bernstein. The framework is designed to parse …
Neton – Tool For Getting Information From Internet Connected Sandboxes
Neton is a tool for getting information from Internet connected sandboxes. It is composed by an agent and a web …
BeatRev – POC For Frustrating/Defeating Malware Analysts
Disclaimer/Liability The work that follows is a POC to enable malware to “key” itself to a particular victim in order …
OffensiveVBA – Code Execution And AV Evasion Methods For Macros In Office Documents
In preparation for a VBS AV Evasion Stream/Video I was doing some research for Office Macro code execution methods and …
Norimaci – Simple And Lightweight Malware Analysis Sandbox For macOS
“Norimaci” is a simple and lightweight malware analysis sandbox for macOS. This tool was inspired by “Noriben“. Norimaci uses the …
ZipExec – A Unique Technique To Execute Binaries From A Password Protected Zip
ZipExec is a Proof-of-Concept (POC) tool to wrap binary-based tools into a password-protected zip file. This zip file is then …
ColdFire – Golang Malware Development Library
Golang malware development framework Introduction ColdFire provides various methods useful for malware development in Golang. Most functions are compatible with …
Wsb-Detect – Tool To Detect If You Are Running In Windows Sandbox (“WSB”)
wsb-detect enables you to detect if you are running in Windows Sandbox (“WSB”). The sandbox is used by Windows Defender …
MacC2 – Mac Command And Control That Uses Internal API Calls Instead Of Command Line Utilities
MacC2 is a macOS post exploitation tool written in python that uses Objective C calls or python libraries as opposed …