kaandemir993/lumma-stealer-dllhost-hollowing-c2-domains-payload-extraction-analysisIn-depth reverse engineering analysis of Lumma Stealer, an info-stealer using process hollowing, Native API calls, and C2 communication. Includes…
tekkenbugattii/linusware-source-code-internalReverse-engineered runtime engine for Roblox/Luau with VM hooking, opcode remapping, capability escalation, and UNC script environment for executing…
sizeable-bingus/massdriverProxies sensitive API calls from shellcode to artifacts for CET-compatible clean call stacks, enabling stealthy payload execution and call stack…
kaandemir993/acrstealer-custom-protocol-credential-theft-payload-extraction-analysisReverse engineering analysis of AcrStealer, a sophisticated info-stealer that uses custom protocols, browser credential theft, and payload…
kaandemir993/dropper-gcleaner-c2-infrastructure-kernel-driver-powershell-conhost-payload-analysisReverse engineering analysis of Dropper GCleaner, a malware that uses a resilient C2 infrastructure, kernel driver loading, PowerShell/Conhost…
virtualesp/springpeace(Hopefully) A tool to root for (most) Android devices through CVE-2026-43499
kaandemir993/agent-tesla-apc-injection-token-manipulation-registry-persistence-analysis"Reverse engineering analysis of Agent Tesla, a .NET-based info-stealer that uses APC injection, token manipulation, and registry persistence.…
kagancapar/cve-2021-47881PoC and analysis of a local stack-buffer-overflow in dataSIMS Avionics ARINC 664-1 v4.5.3, with payload breakdown, reproduction script, and CVE…
iilegacyyii/exportdumperA small tool I made to dump the export table of PE files. The primary use case was intended for use within DLL proxying.
playboisk8/poc-cve-2017-8464-opencalculatorExploiting the .lnk vulnerability and operating system handling mechanisms regarding explorer.exe and USB drives.
cybereason/siofraSimulates the Windows PE loader to identify DLL hijacking vulnerabilities, generates weaponized DLLs with shellcode payloads, and detects UAC…
trustedsec/coffloaderRun Beacon Object Files (BOFs) outside Cobalt Strike by parsing 64-bit COFF object files, with Beacon-compatible argument generation and helper…
yo-yo-yo-jbo/msf_shellcode_analysisStatic analysis walkthrough of a Metasploit Windows shellcode: PowerShell payload decoding, XOR obfuscation, PEB walking, and Export Address Table…
maldev-academy/drmbinviaordinalimportsCreate Anti-Copy DRM Malware
namazso/dll-proxy-generatorGenerate a proxy dll for arbitrary dll
rad9800/pmdPractical Windows malware development course: API hashing, DLL sideloading, shellcode execution, PE manipulation, payload hosting, and delivery labs.
trustedsec/lnkmemaybeLnk crafting and research tools
byt3bl33d3r/nimdllsideloadDLL sideloading/proxying with Nim!
