https://blog.sekoia.io/darkgate-internals

#malware_dev , #delphi , #cpp

⚙️ MultiDump

This is a post-exploitation tool written in C for dumping and extracting LSASS memory discreetly. MultiDump supports LSASS dump via ProcDump.exe or Comsvc.dll, it offers two modes: a local mode that encrypts and stores the dump file locally, and a remote mode that sends the dump to a handler for decryption and analysis

🔗 https://github.com/Xre0uS/MultiDump

#lsass #remote #cpp #python

Reverse engineering cpp - Gal Zaban
[ YouTube ]

Everything you Ever wanted to know about dlls
[ YouTube ]


#conference
#cpp
#windows

🌀Voidgate

A technique that can be used to bypass AV/EDR memory scanners. This can be used to hide well-known and detected shellcodes by performing on-the-fly decryption of individual encrypted assembly instructions, thus rendering memory scanners useless for that specific memory page.

🔗 Source
https://github.com/vxCrypt0r/Voidgate

#av #edr #evasion #hwbp #cpp

How to get the COM concurrency model for the current thread.
by Rbmm & Dennis A. Babkin
https://dennisbabkin.com/blog/?t=things-you-thought-you-knew-how-to-get-com-concurrency-model-for-current-thread

#com #reverse_engineer #cpp