⚠️ malware development

Golang library for malware development

🔥📜 Forbidden collection of Red Team sorcery 📜🔥

Slides & Code snippets for a workshop held @ x33fcon 2024

Reflective DLL Injection Made Bella

Swiss Army Knife for payload encryption, obfuscation, and conversion to byte arrays – all in a single command (14 output formats supported)! ☢️

Malleable shellcode loader written in C and Assembly utilizing direct or indirect syscalls for evading EDR hooks

PIC shellcode (C/C++) development toolkit designed for malware developers.

A ring0 Loadable Kernel Module (Linux) for latest kernels 6.x

In-memory hiding technique

⚠️ Malware Development training ⚠️

Process Hollowing PoC

Generate Secure, Polymorphic, Evasive (lol) Payloads

Articles, White Papers, Technical Write-Ups and more authored by members of the GreySec community. Curated by staff, selected for excellence.

A cryptographic payload loader and executor designed for advanced in-memory execution techniques. This project combines strong encryption, compression, and sophisticated evasion capabilities to execute both shellcode and PE files directly in memory.

go-native-syscall is Go (+ asm) Windows syscall library that resolves, hashes, caches, and invokes direct (and indirect now) NT calls without going through the win api layer traditionally

XMRig Service Installer: An automation tool to swiftly set up the xmrig mining software as a background service on Windows. Designed for educational and research purposes, it streamlines the miner's installation and offers an easy way to run xmrig on-demand.

load arbitrary dlls, call any exported function, calls execute inside g0 as normal syscalls do from the tradition route, no syscall or windows imports, exposes many convenience functions for winapi interaction :3

ECX and eMLR Malware research, Studying mydoom Malware EXECUTION

another pe/dll/shellcode loader that downloads and executes files from urls in memory