https://youtu.be/FiT7-zxQGbo

#c2 #cpp

LdrLoadDll-Unhooking

https://github.com/trickster0/LdrLoadDll-Unhooking

#edr #evasion #dll #cpp

Ares

This project is a PoC loader written in C/C++ based on the Transacted Hollowing technique. It features:

— PPID spoofing
— Dynamic function resolution with API hashing
— NTDLL unhooking
— AES256 CBC Encryption
— CIG to block non-Microsoft-signed binaries

https://github.com/Cerbersec/Ares

#edr #evasion #cpp

Malware Analysis: Syscalls

Great guide and overview about Syscalls and how to start diagnosing them.

https://jmpesp.me/malware-analysis-syscalls-example/

#maldev #cpp #syscall

Evading WinDefender ATP Credential Theft

https://b4rtik.github.io/posts/evading-windefender-atp-credential-theft-kernel-version/

#windows #native #api #kernel #cpp

RefleXXion

RefleXXion is a utility designed to aid in bypassing user-mode hooks utilised by AV/EPP/EDR etc. In order to bypass the user-mode hooks, it first collects the syscall numbers of the NtOpenFile, NtCreateSection, NtOpenSection and NtMapViewOfSection found in the LdrpThunkSignature array.

https://github.com/hlldz/RefleXXion

#edr #evasion #cpp #redteam

FunctionStomping

This is a brand-new technique for shellcode injection to evade AVs and EDRs. This technique is inspired by Module Stomping and has some similarities.The big advantage of this technique is that it isn't overwritting an entire module or PE, just one function and the target process can still use any other function from the target module.

https://github.com/Idov31/FunctionStomping

#edr #evasion #stomping #maldev #cpp

EmbedExeLnk

Embedding an EXE inside a LNK with automatic execution

https://www.x86matthew.com/view_post?id=embed_exe_lnk

#embed #lnk #exe #cpp

Useful Libraries for Malware Development

https://captmeelo.com/redteam/maldev/2022/02/16/libraries-for-maldev.html

#edr #evasion #lib #maldev #cpp

KernelCallbackTable Injection

KernelCallbackTable which could be abused to inject shellcode in a remote process. This method of process injection was used by FinFisher/FinSpy and Lazarus.

https://captmeelo.com/redteam/maldev/2022/04/21/kernelcallbacktable-injection.html

#edr #bypass #injection #cpp #maldev

💤 laZzzy

This is a shellcode loader, developed using different open-source libraries, that demonstrates different execution techniques.

Features:
— Direct syscalls and native functions;
— Import Address Table (IAT) evasion;
— Encrypted payload (XOR and AES);
— PPID spoofing;
— Blocking of non-Microsoft-signed DLLs;
— etc.

https://github.com/capt-meelo/laZzzy

#maldev #loader #cpp #redteam