⚠️ malware development

Golang library for malware development

🔥📜 Forbidden collection of Red Team sorcery 📜🔥

Slides & Code snippets for a workshop held @ x33fcon 2024

Reflective DLL Injection Made Bella

Swiss Army Knife for payload encryption, obfuscation, and conversion to byte arrays – all in a single command (14 output formats supported)! ☢️

Shellcode loader written in C and Assembly utilizing direct or indirect syscalls to evade UM EDR hooks

PIC shellcode (C/C++) development toolkit designed for malware developers.

Erebus is an Initial Access wrapper for the Mythic Command & Control Server. It converts existing Mythic shellcode into payloads specifically used for phishing and IA operations.

A ring0 Loadable Kernel Module (Linux) for latest kernels 6.x

Creation of multiple Malware tools consisting of evasion, enumeration and exploitation

In-memory hiding technique

Process Hollowing PoC

⚠️ Malware Development training ⚠️

Generate Secure, Polymorphic, Evasive (lol) Payloads

Articles, White Papers, Technical Write-Ups and more authored by members of the GreySec community. Curated by staff, selected for excellence.

load arbitrary dlls, call any exported function, calls execute inside g0 as normal syscalls do from the traditional route, no syscall or windows imports, exposes many convenience functions for winapi interaction :3

A cryptographic payload loader and executor designed for advanced in-memory execution techniques. This project combines strong encryption, compression, and sophisticated evasion capabilities to execute both shellcode and PE files directly in memory.

go-native-syscall is Go (+ asm) Windows syscall library that resolves, hashes, caches, and invokes direct (and indirect now) NT calls without going through the win api layer traditionally

low-level windows networking library using afd.sys sockets and schannel tls. bypasses winsock, winhttp, wininet and other high-level networking apis entirely.