Tool for Fingerprinting HTTP requests of malware. Based on Tshark and written in Python3. Working prototype stage 🙂 Its main …
LightsOut – Generate An Obfuscated DLL That Will Disable AMSI And ETW
LightsOut will generate an obfuscated DLL that will disable AMSI & ETW while trying to evade AV. This is done …
Subparse – Modular Malware Analysis Artifact Collection And Correlation Framework
Subparse, is a modular framework developed by Josh Strochein, Aaron Baker, and Odin Bernstein. The framework is designed to parse …
Neton – Tool For Getting Information From Internet Connected Sandboxes
Neton is a tool for getting information from Internet connected sandboxes. It is composed by an agent and a web …
BeatRev – POC For Frustrating/Defeating Malware Analysts
Disclaimer/Liability The work that follows is a POC to enable malware to “key” itself to a particular victim in order …
OffensiveVBA – Code Execution And AV Evasion Methods For Macros In Office Documents
In preparation for a VBS AV Evasion Stream/Video I was doing some research for Office Macro code execution methods and …
Norimaci – Simple And Lightweight Malware Analysis Sandbox For macOS
“Norimaci” is a simple and lightweight malware analysis sandbox for macOS. This tool was inspired by “Noriben“. Norimaci uses the …
ZipExec – A Unique Technique To Execute Binaries From A Password Protected Zip
ZipExec is a Proof-of-Concept (POC) tool to wrap binary-based tools into a password-protected zip file. This zip file is then …
ColdFire – Golang Malware Development Library
Golang malware development framework Introduction ColdFire provides various methods useful for malware development in Golang. Most functions are compatible with …
Wsb-Detect – Tool To Detect If You Are Running In Windows Sandbox (“WSB”)
wsb-detect enables you to detect if you are running in Windows Sandbox (“WSB”). The sandbox is used by Windows Defender …