MalDev

Hey! Welcome to my repo :))))

I am Captain Magma, a passionate individual dedicated to cybersecurity, malware development, and analysis.

The design for this repository is to manage my MalDev road-path as I learn and update this repository with my notes and code.
I am not the author of any of these techniques, this is just my implementation of them.

[!Important] I just wanted to clarify that I am not an expert at all, I am noobish at best. That being said, please don't expect amazing APT sort of malware coming from this repo. I also wanted to say that this repository is designed for educational purposes only. Not only will you get caught immediately with this code, but it is also illegal to do so on systems you do not own.

Current Projects and Standings

As of right now, this is a growing repository, and as such, there will be many updates for all the code here to ensure it works as intended.
As of writing this, these are the current programs completed and working:

• Encryption

  • RC4
  • XOR
  • AES-256-GCM
  • ChaCha20
  • Heap Encryption

• Hashing

  • DJB2
  • SDBM
    • SDBMROL16

• Obfuscation

  • GetModuleHandle
  • GetProcAddress
  • Api Hashing
  • PPID Spoofing
  • Double Obfuscation (GetProcAddress + GetModuleHandle)
  • Memcpy + Strcpy + Strcmp
  • Compile Time Hashing
  • Process Re-Imaging

• Native API

  • NT Shellcode Injection

• Ntdll Unhooking

  • Map From Disk
  • Read From File
  • Suspended Process

• System Calls

  • APC Syscalls
  • Direct Syscalls
  • Indirect Syscalls

• Thread Hijacking

  • Local
    • WinApi
    • Syscalls
  • Remote
    • WinApi
    • Syscalls

• Mapping Injection

  • Local
    • WinApi
    • Syscalls
  • Remote
    • WinApi
    • Syscalls

• Anti-Analysis

  • Being Debugged
  • Self Delete

• Anti-Sandbox

  • Check Memory
  • CPUID
  • SMBIOS

• Enumeration

  • CreateToolhelp32Snapshot
  • NtQuerySysInfo
  • OS Metadata

• Process Injection

  • Shellcode Injection
  • APC Injection
  • Fiber Injection
  • Early Bird Injection
  • Process Hypnosis

• Stomping

  • Local
  • Remote

• Misc

  • Grab Pe Headers
  • Suspended Process
  • Read Target File
  • Fix IAT
  • Fix Reloc Table
  • Blue Screen Of Death
  • Map Dll File
  • Change Protections

• Hollowing

  • Process Hollowing
    • WinApi
    • Syscall
  • Hypnosis Hollowing

• ETW Bypass

  • Etw Byte Patching
  • NtTraceEvent SSN Patching

• AMSI Bypass

  • Amsi Byte Patching

• Magma Gate

  • Magma Gate

• Reflective Dll

  • Reflective Dll

• Dll Injection

  • Basic DLL Injection
  • Syscall Dll Injection
  • Dll Hijacking
  • Dll Sideloading

• Persistence

  • Windows Registry
  • Windows Services

• Sleep Obfuscation

  • Sleep Obfuscation

• LSASS

  • MiniDumpWriteDump

• PE Injection

  • Portable Executable Injection
  • Module Overloading

• Privilege Escalation

  • Token Manipulation
  • PPID Privilege Escalation

Errors

I am not some sort of amazing programming, and that clearly reflects in my code. If there are any issues in any of my programs, feel free to make a pull request or point it out in the errors section!

Thank You

With that being said, thanks for checking out my repo, and I hope you find something interesting :))))