
ghost
Lightweight RAT providing silent remote command-line access, hidden file download/execution, and persistence mechanisms for Windows systems.…
command-and-controleducationmalware-analysis+5

Lightweight RAT providing silent remote command-line access, hidden file download/execution, and persistence mechanisms for Windows systems.…

Windows kernel driver that removes Process Protection (PP) and Process Protection Light (PPL).

A Windows userland tool to enumerate and classify ALPC ports, including PPL-protected processes.

Builds an ELAM driver and service that launches a signed child process as an Anti-Malware Protected Process-Light (PPL) on Windows, for security…