Hack in paris: Malware development for dummies

#malware_dev
@islemolecule_source

93 cobalt strike beacons:)

Fuzzing the TCP/IP stack

Credit: Ilja van Sprundel

https://media.ccc.de/v/37c3-12235-fuzzing_the_tcp_ip_stack

#fuzzing, #tcp
—-
@islemolecule_source

x86 Nirvana Hooks & Manual Syscall Detection
credit : @xenosCR

https://blog.xenoscr.net/2022/01/17/x86-Nirvana-Hooks.html

#syscall ,
———
@islemolecule_source

awesome malware analysis tools and resources

Github
_____
@islemolecule_source

Quickly develop malware and bypass 90% of anti-virus software

Credit: Yu Cuan

Link

#malware_dev
_-------
@islemolecule_source

10 Underrated Resources about Malware Techniques

Credit: Thomas Roccia
Link

#malware_dev #malware_analysis
----------------------------------
@islemolecule_source

Black Mass" Volume 2 - Malware Development Guide

#Black_Mass
#VX_Underground
#malware_dev
@islemolecule_source

[ EDRSilencer ]

A tool uses Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the server.

EDR list:

Microsoft Defender for Endpoint and Microsoft Defender Antivirus
"MsMpEng.exe",
"MsSense.exe",
Elastic EDR
"elastic-agent.exe",
"elastic-endpoint.exe",
"filebeat.exe",
Trellix EDR
"xagt.exe"

https://github.com/netero1010/EDRSilencer

#EDR

@islemolecule_source

native api documentation
https://ntdoc.m417z.com/processinfoclass

#win_api
@islemolecule_source

📘LOLBIN ATTACK & DEFENSE🛠

@islemolecule_source
#lolbin
#malware_dev

"Shellcode Development", 2023

#shellcode
#malware_dev
@islemolecule_source

analyzing-decompiled-C++

#reverse

@islemolecule_source

PingRAT: secretly passes C2 traffic through firewalls using ICMP payloads

https://github.com/umutcamliyurt/PingRAT

#c2 ,#tool , #go
———
@islemolecule_source

PSRansom: a PowerShell Ransomware Simulator with C2 Server capabilities.

https://github.com/JoelGMSec/PSRansom

#c2 , #powershell , #simulat , #tool
———
@islemolecule_source

TLDR; 4 new releases from @myhackerhouse
for your malware development and analysis purposes with 3 re-created from the CIA's Vault7 leak.

1. https://github.com/hackerhouse-opensource/marble

2. https://github.com/hackerhouse-opensource/WMIProcessWatcher

3. https://github.com/hackerhouse-opensource/Artillery

4. https://github.com/hackerhouse-opensource/SignToolEx


#malware_dev ,#analysis ,
———
@islemolecule_source

How to break bare metal firmware encryption (FortiGate firewalls) for security research.
Credits: Jon Williams (@bishopfox)

https://bishopfox.com/blog/breaking-fortinet-firmware-encryption

#firewall, #fortigate ,
———
@islemolecule_source

Browser Extension Pentesting Methodology
credit : @hacktricks_live

https://book.hacktricks.xyz/pentesting-web/browser-extension-pentesting-methodology

#methodology
———
@islemolecule_source