creating a Rootkit to Learn C

credit : @h0mbre_

https://h0mbre.github.io/Learn-C-By-Creating-A-Rootkit/#

#rootkit ,

Reminder that creating a memory dump of Outlook.exe not only produces access tokens but also potentially sensitive email content.

Stealing Access Tokens From Office Desktop Applications :
https://mrd0x.com/stealing-tokens-from-office-applications/

credit : @mrd0x

#memory_dump ,

Writing A Decent Win32 Keylogger

synacktiv.com/publications/w…


#key_logger
@islemolecule_source

C2 development guide

https://www.soheilsec.com/توسعه-بدافزار-c2

Language: Persian

credit: @soheilsec

#c2 ,
@islemolecule_source

C2 Matrix

docs

#c2
@islemolecule_source

GitBook
Building C2 Implants in C++: A Primer: Introduction

https://shogunlab.gitbook.io

#c2
@islemolecule_source

Hack in paris: Malware development for dummies

#malware_dev
@islemolecule_source

93 cobalt strike beacons:)

Fuzzing the TCP/IP stack

Credit: Ilja van Sprundel

https://media.ccc.de/v/37c3-12235-fuzzing_the_tcp_ip_stack

#fuzzing, #tcp
—-
@islemolecule_source

x86 Nirvana Hooks & Manual Syscall Detection
credit : @xenosCR

https://blog.xenoscr.net/2022/01/17/x86-Nirvana-Hooks.html

#syscall ,
———
@islemolecule_source

awesome malware analysis tools and resources

Github
_____
@islemolecule_source

Quickly develop malware and bypass 90% of anti-virus software

Credit: Yu Cuan

Link

#malware_dev
_-------
@islemolecule_source

10 Underrated Resources about Malware Techniques

Credit: Thomas Roccia
Link

#malware_dev #malware_analysis
----------------------------------
@islemolecule_source

Black Mass" Volume 2 - Malware Development Guide

#Black_Mass
#VX_Underground
#malware_dev
@islemolecule_source

[ EDRSilencer ]

A tool uses Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the server.

EDR list:

Microsoft Defender for Endpoint and Microsoft Defender Antivirus
"MsMpEng.exe",
"MsSense.exe",
Elastic EDR
"elastic-agent.exe",
"elastic-endpoint.exe",
"filebeat.exe",
Trellix EDR
"xagt.exe"

https://github.com/netero1010/EDRSilencer

#EDR

@islemolecule_source

native api documentation
https://ntdoc.m417z.com/processinfoclass

#win_api
@islemolecule_source

📘LOLBIN ATTACK & DEFENSE🛠

@islemolecule_source
#lolbin
#malware_dev

"Shellcode Development", 2023

#shellcode
#malware_dev
@islemolecule_source

analyzing-decompiled-C++

#reverse

@islemolecule_source