cylancevulnresearch/reflectivedllrefresherReflective DLL that scans process memory and unhooks loaded libraries to evade security software, with UPX, TLS injector, and Meterpreter integration.
habanada/nativemirrorNative Delphi implementation of PE-sieve functionality with a reusable library, CLI, and PE-sieve-compatible DLL for HollowsHunter integration.
kaandemir993/overlord-rat-reverse-engineering-a-go-based-rat-injection-keylogging-c2-exfiltration-analysisFull static & memory analysis of Overlord RAT: Go agent architecture, HTTP/2 + WebSocket C2, reflective DLL injection, browser keylogging, and IOCs.…
gmh5225/iat-hookC++ DLL that performs Import Address Table hooking by parsing PE headers and redirecting imported function addresses to a custom hook inside a target…
dmitry-matvienko/malware-analysis-fake-hwmonitorTechnical analysis, writeup, and YARA rules for a DLL Sideloading campaign disguised as HWMonitor
strivexjun/memorymoduleppC++ library to load DLLs directly from memory without touching disk, with exception handling support, enabling stealthy code execution and evasion of…
withsecurelabs/doublepulsar-usermode-injectorA utility to use the usermode shellcode from the DOUBLEPULSAR payload to reflectively load an arbitrary DLL into another process, for use in testing…
s3c/globalprotect-ca-cert-ipcProof-of-concept exploit for CVE-2025-0117 in GlobalProtect, achieving privilege escalation to SYSTEM via a backdoored installer and DLL injection.
dodo-sec/astaroth-deobfuscatorIDA python script for deobfuscating Astaroth/Guildma injector DLL
sh0ckfr/lockbit3.0-mpclient-defender-pocLockbit3.0 Microsoft Defender MpClient.dll DLL Hijacking PoC
florylsk/execitExecute shellcode files with rundll32
7etsuo/windows-api-function-cheatsheetsA reference of Windows API function calls, including functions for file operations, process management, memory management, thread management,…
rad9800/pmdPractical Windows malware development course: API hashing, DLL sideloading, shellcode execution, PE manipulation, payload hosting, and delivery labs.
paddycahil/windows-api-function-cheatsheetsA reference of Windows API function calls, including functions for file operations, process management, memory management, thread management,…
jas502n/phpstudy-backdoorphpstudy dll backdoor for v2016 and v2018
lan1oc/cve-2023-34312-expReproduction of CVE-2023-34312 using two malicious DLL files to exploit QQ and TIM messaging applications for security research and testing.
paolokappa/sharepointsecuritymonitorA comprehensive PowerShell-based SharePoint security monitoring solution with CVE-2025-53770 protection, advanced DLL analysis, threat detection, and…
zer0t0/cve-2025-56383-proof-of-conceptCVE-2025-56383-Proof-of-Concept
