An open API service providing repository metadata for many open source software ecosystems.

GitHub topics: av-evasion

thomasxm/BOAZ_beta

Multilayered AV/EDR Evasion Framework

Language: C++ - Size: 85.6 MB - Last synced at: 1 day ago - Pushed at: 2 days ago - Stars: 617 - Forks: 102

VirtualAlllocEx/Direct-Syscalls-vs-Indirect-Syscalls

The following two code samples can be used to understand the difference between direct syscalls and indirect syscalls

Language: C - Size: 24.4 KB - Last synced at: about 9 hours ago - Pushed at: about 1 year ago - Stars: 185 - Forks: 24

VirtualAlllocEx/Direct-Syscalls-A-journey-from-high-to-low

Start with shellcode execution using Windows APIs (high level), move on to native APIs (medium level) and finally to direct syscalls (low level).

Language: C - Size: 592 KB - Last synced at: about 9 hours ago - Pushed at: almost 2 years ago - Stars: 133 - Forks: 23

klezVirus/SilentMoonwalk

PoC Implementation of a fully dynamic call stack spoofer

Language: C++ - Size: 292 KB - Last synced at: 8 days ago - Pushed at: 9 months ago - Stars: 758 - Forks: 99

CroodSolutions/AutoPwnKey

AutoPwnKey is a red teaming framework and testing tool using AutoHotKey (AHK), which at the time of creation proves to be quite evasive. It is our hope that this tool will be useful to red teams over the short term, while over the long term help AV/EDR vendors improve how they handle AHK scripts.

Language: AutoHotkey - Size: 1.28 MB - Last synced at: 9 days ago - Pushed at: 9 days ago - Stars: 25 - Forks: 5

bytecode77/r77-rootkit

Fileless ring 3 rootkit with installer and persistence that hides processes, files, network connections, etc.

Language: C - Size: 5.08 MB - Last synced at: 9 days ago - Pushed at: 26 days ago - Stars: 1,877 - Forks: 426

truelockmc/Discord-RAT

A discord Remote Administration Tool. Easy to use, undetected and powerfull.

Language: Python - Size: 21.3 MB - Last synced at: 9 days ago - Pushed at: 9 days ago - Stars: 7 - Forks: 1

bytecode77/pe-union

Crypter, binder & downloader with native & .NET stub, evasive by design, user friendly UI

Language: Assembly - Size: 5.67 MB - Last synced at: 6 days ago - Pushed at: 5 months ago - Stars: 679 - Forks: 149

Ch0pin/AVIator

Antivirus evasion project

Language: C# - Size: 3.12 MB - Last synced at: 6 days ago - Pushed at: 3 months ago - Stars: 1,095 - Forks: 226

EvilBytecode/EByte-VBS-Obfuscator-Go

VBS-Obfuscator-GO is a Go-based tool designed for obfuscating VBScript (VBS) files. It transforms readable VBScript code into a less recognizable form by employing random variable names and encoding character values using mathematical operations. This helps protect scripts from casual inspection and modification.

Language: Go - Size: 7.81 KB - Last synced at: 1 day ago - Pushed at: 8 months ago - Stars: 35 - Forks: 5

WesleyWong420/RedTeamOps-Havoc-101

Materials for the workshop "Red Team Ops: Havoc 101"

Language: C# - Size: 22.9 MB - Last synced at: 9 days ago - Pushed at: 7 months ago - Stars: 371 - Forks: 50

klezVirus/inceptor

Template-Driven AV/EDR Evasion Framework

Language: Assembly - Size: 19.9 MB - Last synced at: 13 days ago - Pushed at: over 1 year ago - Stars: 1,658 - Forks: 271

N3M3S1Spy/InjectionLab

InjectionLab is an educational toolkit showcasing various Windows code injection techniques. It provides well-documented examples for security researchers and defenders to explore process injection, memory manipulation, and detection strategies.

Language: C++ - Size: 66.4 KB - Last synced at: 11 days ago - Pushed at: 14 days ago - Stars: 0 - Forks: 0

n1nj4sec/pymemimporter

import pyd or execute PE all from memory using only pure python code and some shellcode tricks

Language: Python - Size: 256 KB - Last synced at: 6 days ago - Pushed at: about 8 years ago - Stars: 74 - Forks: 15

Chainski/AES-Encoder

PowerShell Obfuscator. A PowerShell script anti-virus evasion tool

Language: PowerShell - Size: 108 KB - Last synced at: 11 days ago - Pushed at: 5 months ago - Stars: 71 - Forks: 19

f1zm0/acheron

indirect syscalls for AV/EDR evasion in Go assembly

Language: Assembly - Size: 332 KB - Last synced at: 15 days ago - Pushed at: almost 2 years ago - Stars: 325 - Forks: 38

yutianqaq/BypassAV-Online

An online AV evasion platform written in Springboot (Golang, Nim, C) supports inline, local and remote loading of Shellocde methods.

Language: Java - Size: 10.6 MB - Last synced at: 11 days ago - Pushed at: about 1 year ago - Stars: 118 - Forks: 11

yutianqaq/AVEvasionCraftOnline

An online AV evasion platform written in Springboot (Golang, Nim, C) supports embedded, local and remote loading of Shellocde methods.

Language: Go - Size: 1.82 MB - Last synced at: 14 days ago - Pushed at: 12 months ago - Stars: 326 - Forks: 51

TryCatchHCF/Cloakify

CloakifyFactory - Data Exfiltration & Infiltration In Plain Sight; Convert any filetype into list of everyday strings, using Text-Based Steganography; Evade DLP/MLS Devices, Defeat Data Whitelisting Controls, Social Engineering of Analysts, Evade AV Detection

Language: Python - Size: 17.9 MB - Last synced at: 22 days ago - Pushed at: over 4 years ago - Stars: 1,590 - Forks: 233

D3Ext/maldev

Golang library for malware development

Language: Go - Size: 1.64 MB - Last synced at: 12 days ago - Pushed at: 5 months ago - Stars: 348 - Forks: 32

JenarGithub76/payload-obfuscator

A Python-based tool for studying and practicing Windows PE binary obfuscation techniques.

Size: 1000 Bytes - Last synced at: 25 days ago - Pushed at: 25 days ago - Stars: 3 - Forks: 0

lengjibo/FourEye

AV Evasion Tool For Red Team Ops

Language: C - Size: 2.34 MB - Last synced at: 16 days ago - Pushed at: over 3 years ago - Stars: 757 - Forks: 153

f1zm0/hades

Go shellcode loader that combines multiple evasion techniques

Language: Go - Size: 2.12 MB - Last synced at: 15 days ago - Pushed at: almost 2 years ago - Stars: 364 - Forks: 46

swagkarna/Defeat-Defender-V1.2.0

Powerful batch script to dismantle complete windows defender protection and even bypass tamper protection ..Disable Windows-Defender Permanently....Hack windows. POC

Language: Batchfile - Size: 18.4 MB - Last synced at: 27 days ago - Pushed at: over 1 year ago - Stars: 1,529 - Forks: 311

EvilBytecode/veh-syscalls-shellcode

dm @codepulze1 on discord or codepulze on telegram to buy VEH syscalls, ssn resolving, 4/21. read readme.md

Size: 4.88 KB - Last synced at: 29 days ago - Pushed at: 29 days ago - Stars: 2 - Forks: 1

EvilBytecode/EByte-Shellcode-Loader

shellcode loader that uses indirect syscalls written in D Lang The loader bypasses user-mode hooks by resolving system calls manually from NTDLL using a hash-based method.

Language: D - Size: 142 KB - Last synced at: 6 days ago - Pushed at: 7 months ago - Stars: 9 - Forks: 1

EvilBytecode/Nyx-Full-Dll-Unhook

(EDR) Dll Unhooking = kernel32.dll, kernelbase.dll, ntdll.dll, user32.dll, apphelp.dll, msvcrt.dll.

Language: Go - Size: 36.1 KB - Last synced at: 1 day ago - Pushed at: 9 months ago - Stars: 19 - Forks: 3

EvilBytecode/ETW-Patch

code snippet provided demonstrates how to patch the EtwEventWrite function in the ntdll.dll library on Windows using CGO (C Go).

Language: Go - Size: 4.88 KB - Last synced at: 1 day ago - Pushed at: 10 months ago - Stars: 8 - Forks: 1

JoelGMSec/Darkbyte

Repository of tools used in my blog

Language: C - Size: 13.2 MB - Last synced at: 20 days ago - Pushed at: about 1 year ago - Stars: 51 - Forks: 18

Enelg52/Backpack

Golang packer that use process hollowing

Language: Go - Size: 53.7 KB - Last synced at: 22 days ago - Pushed at: almost 3 years ago - Stars: 17 - Forks: 4

aniko33/pe-packer-x64

A simple template PE Packer (x64)

Language: C - Size: 17.6 KB - Last synced at: 9 days ago - Pushed at: 9 months ago - Stars: 2 - Forks: 0

hlldz/SpookFlare 📦

Loader, dropper generator with multiple features for bypassing client-side and network-side countermeasures.

Language: Python - Size: 76.2 KB - Last synced at: 19 days ago - Pushed at: almost 6 years ago - Stars: 948 - Forks: 188

m0rd3caii/goRAT

This Remote Access Tool (RAT), built with Go, is controlled via a Discord bot. The bot connects to a target machine and allows remote control through Discord commands.

Language: Go - Size: 21.7 MB - Last synced at: about 2 months ago - Pushed at: about 2 months ago - Stars: 1 - Forks: 0

noderaven/payload-obfuscator

A Python-based tool for studying and practicing Windows PE binary obfuscation techniques.

Language: Python - Size: 132 KB - Last synced at: 19 days ago - Pushed at: about 2 months ago - Stars: 1 - Forks: 0

x86-512/Metamorpheus

A metamorphic shellcode obfuscator capable of generating more unique shellcodes than there are atoms in the OBSERVABLE UNIVERSE and designed for shellcodes/implants that need to run in W^X memory.

Language: Python - Size: 384 KB - Last synced at: 12 days ago - Pushed at: 3 months ago - Stars: 1 - Forks: 1

Vasco0x4/ShellLoader_Hub

Shellcode Loader Library.

Size: 9.77 KB - Last synced at: 10 days ago - Pushed at: 3 months ago - Stars: 9 - Forks: 1

EvilBytecode/PayloadCrypter

Go Based Crypter That Can Bypass Any Kinds Of Antivirus Products, payload crypter supports over 4 programming languages.

Language: Go - Size: 27.3 KB - Last synced at: 1 day ago - Pushed at: 10 months ago - Stars: 42 - Forks: 7

swagkarna/Chuvi-Botnet

Fud Persistent Windows Backdoor developed purely in python

Language: Python - Size: 3.91 MB - Last synced at: about 1 month ago - Pushed at: about 4 years ago - Stars: 29 - Forks: 14

athenahax/pie

Encode raw bytes into their corresponding locations in pi. (PoC)

Language: C - Size: 11.7 KB - Last synced at: 4 months ago - Pushed at: 4 months ago - Stars: 1 - Forks: 0

VirtualAlllocEx/Create_Thread-Inline_Assembly_x86_Fibers

This POC provides the ability to execute x86 shellcode in the form of a .bin file based on x86 inline assembly and execution over fibers

Language: C++ - Size: 466 KB - Last synced at: about 9 hours ago - Pushed at: about 2 years ago - Stars: 7 - Forks: 4

VirtualAlllocEx/Create_Thread_Inline_Assembly_x86

This POC provides the possibilty to execute x86 shellcode in form of a .bin file based on x86 inline assembly

Language: C++ - Size: 563 KB - Last synced at: about 9 hours ago - Pushed at: about 2 years ago - Stars: 18 - Forks: 9

VirtualAlllocEx/Shell-we-Assembly

Shellcode execution via x86 inline assembly based on MSVC syntax

Language: C++ - Size: 26.4 KB - Last synced at: 6 days ago - Pushed at: almost 2 years ago - Stars: 13 - Forks: 5

VirtualAlllocEx/DSC_SVC_REMOTE

This code example allows you to create a malware.exe sample that can be run in the context of a system service, and could be used for local privilege escalation in the context of an unquoted service path, etc. The payload itself can be remotely hosted, downloaded via the wininet library and then executed via direct system calls.

Language: C - Size: 21.5 KB - Last synced at: about 9 hours ago - Pushed at: almost 2 years ago - Stars: 51 - Forks: 11

Lucas310302/Coin-Nest

XMR Miner Malware

Language: Python - Size: 6.48 MB - Last synced at: 9 days ago - Pushed at: over 1 year ago - Stars: 7 - Forks: 3

x0reaxeax/SyscallHookBypass

NTAPI hook bypass with (semi) legit stack trace

Language: C - Size: 8.79 KB - Last synced at: 6 days ago - Pushed at: almost 2 years ago - Stars: 14 - Forks: 2

x0reaxeax/SilentWrite

PoC arbitrary WPM without a process handle

Language: C - Size: 9.77 KB - Last synced at: 6 days ago - Pushed at: over 1 year ago - Stars: 18 - Forks: 3

swagkarna/PuttyorMalware

Using bitsadmin to download our malware and to bypass defender

Language: Visual Basic .NET - Size: 750 KB - Last synced at: about 1 month ago - Pushed at: about 4 years ago - Stars: 27 - Forks: 12

Vith0r/Indirect-Syscalls

Indirect Syscalls Loader

Language: C - Size: 14.6 KB - Last synced at: 4 months ago - Pushed at: 6 months ago - Stars: 0 - Forks: 0

GetRektBoy724/MeterPwrShell 📦

Automated Tool That Generates The Perfect Meterpreter Powershell Payload

Size: 253 KB - Last synced at: 5 months ago - Pushed at: over 3 years ago - Stars: 224 - Forks: 41

GetRektBoy724/SharpUnhooker

C# Based Universal API Unhooker

Language: C# - Size: 443 KB - Last synced at: 5 months ago - Pushed at: about 3 years ago - Stars: 391 - Forks: 75

aniko33/Crystal 📦

A simple stealer made in Rust, written for fun

Language: Rust - Size: 72.3 KB - Last synced at: 9 days ago - Pushed at: 9 months ago - Stars: 3 - Forks: 0

KnightChaser/kaldrexx

A simple HTTPS reverse shell malware implementation written in Go, evading Windows Defender detection via AES

Language: Go - Size: 1.51 MB - Last synced at: 28 days ago - Pushed at: about 1 year ago - Stars: 1 - Forks: 0

Souhardya/IMProtector

Old 32 bit PE executable protector / crypter

Language: C++ - Size: 35.2 KB - Last synced at: 22 days ago - Pushed at: over 3 years ago - Stars: 14 - Forks: 8

julecko/AV-Evasion

Simple but effective methods to avoid being detected by antivirus

Language: C - Size: 2.7 MB - Last synced at: 7 months ago - Pushed at: 7 months ago - Stars: 0 - Forks: 0

VEN0MTOOLS/VENOM-FUD-CRYPTER-SOFTWARE

FUD Crypter is encryption tool. You can make FUD your files to bypass antiviruses “Windows Defender AMSI” etc. Also you can protect your own codes with FUD Crypter 2024. You can get FUD Results with Crypter FUD 2024 on Scantime and Runtime. Your file will be secure with our encryption.

Size: 5.86 KB - Last synced at: 8 months ago - Pushed at: 8 months ago - Stars: 0 - Forks: 0

thomasxm/BOAZ

A Multilayered AV/EDR Evasion Framework and AV Testing Tool.

Size: 50.8 KB - Last synced at: 8 months ago - Pushed at: 8 months ago - Stars: 2 - Forks: 0

swagkarna/shell_gain-v1

reverse shell

Language: Python - Size: 5.86 KB - Last synced at: 18 days ago - Pushed at: about 5 years ago - Stars: 6 - Forks: 1

ANK1036Official/Satangle

Script which helps the creation of antivirus evading malware.

Language: Shell - Size: 4.88 KB - Last synced at: 16 days ago - Pushed at: about 8 years ago - Stars: 4 - Forks: 2

24greyhat/Hips

Hidden in plain sight! simple yet effective covert way to obfuscate data (e.g., shellcode), no one will tell gibberish from malicious!

Language: Python - Size: 1000 Bytes - Last synced at: 12 days ago - Pushed at: 12 months ago - Stars: 2 - Forks: 2

acheong08/py-obfuscate

Obfuscate python code to a single Unicode one liner

Language: Python - Size: 410 KB - Last synced at: 6 days ago - Pushed at: over 2 years ago - Stars: 5 - Forks: 1

Ponk445/PDF-EXPLOIT

FUD PDF EXPLOIT SOURCE CODE, reverse shell using pdf file

Language: Python - Size: 213 KB - Last synced at: 9 months ago - Pushed at: 9 months ago - Stars: 14 - Forks: 2

Cipher7/ApexLdr

ApexLdr is a DLL Payload Loader written in C

Language: C - Size: 738 KB - Last synced at: 9 months ago - Pushed at: 9 months ago - Stars: 72 - Forks: 16

Enelg52/Gofrette

Gofrette is a reverse shell payload developed in Golang that bypasses Windows defender and many others anti-virus.

Language: Go - Size: 6.87 MB - Last synced at: 10 months ago - Pushed at: over 2 years ago - Stars: 37 - Forks: 7

VBV11/WinRM-Reverse-Shell

WinRM Reverse Shell Using Powershell.

Language: PowerShell - Size: 45.9 KB - Last synced at: 12 months ago - Pushed at: 12 months ago - Stars: 2 - Forks: 0

Chainski/Chainski-Crypter Fork of NYAN-x-CAT/Lime-Crypter

Lime Crypter Obfuscator Mod

Language: C# - Size: 4.99 MB - Last synced at: 12 months ago - Pushed at: 12 months ago - Stars: 23 - Forks: 6

digilolnet/pint-c2

eBPF evading C2

Language: Python - Size: 18.6 KB - Last synced at: about 1 month ago - Pushed at: about 1 year ago - Stars: 0 - Forks: 0

unknxwnleaks/Crypter

My personal "MUCKCrypter" a longtime project.

Size: 0 Bytes - Last synced at: about 1 year ago - Pushed at: about 1 year ago - Stars: 0 - Forks: 0

pard0p/CallstackSpoofingPOC

C++ self-Injecting dropper based on various EDR evasion techniques.

Language: C - Size: 46.9 KB - Last synced at: about 1 year ago - Pushed at: about 1 year ago - Stars: 255 - Forks: 55

hackerOrionX/ORIONX-FUD-CRYPTER

The only FREE and 100% FUD crypter that will still FUD, work on Windows. Powerfull obfuscator to bypass Anti-Viruses detection.

Language: Tcl - Size: 97 MB - Last synced at: about 1 year ago - Pushed at: about 1 year ago - Stars: 33 - Forks: 3

DigiDonkz/TheCrypter

Web-based Polymorphic Runtime Crypter FUD

Size: 760 KB - Last synced at: about 1 year ago - Pushed at: about 1 year ago - Stars: 2 - Forks: 0

njcve/inflate.py

Artificially inflate a given binary to exceed common EDR file size limits. Can be used to bypass common EDR.

Language: Python - Size: 3.91 KB - Last synced at: about 1 year ago - Pushed at: about 3 years ago - Stars: 112 - Forks: 15

Mystery-Dynamics/Mys_C2Exchange

Simple C2 via MS Exchange HTTP to evade AV and Network Traffic Restrictions.

Language: Go - Size: 17.6 KB - Last synced at: over 1 year ago - Pushed at: about 2 years ago - Stars: 1 - Forks: 0

Sma-Das/powershell-utils

A repository containing utilities related to PowerShell

Language: PowerShell - Size: 279 KB - Last synced at: over 1 year ago - Pushed at: over 1 year ago - Stars: 1 - Forks: 0

winterrdog/fast_entropy_calc

Calculate the Shannon entropy of the provided file.

Language: C++ - Size: 17.6 KB - Last synced at: 7 days ago - Pushed at: about 2 years ago - Stars: 5 - Forks: 0

AdvDebug/MineRootkit 📦

PoC Windows Usermode Rootkit made in C# and C++, made to show you how to protect your process using hooking.

Language: C# - Size: 53.7 KB - Last synced at: over 1 year ago - Pushed at: over 1 year ago - Stars: 52 - Forks: 12

GetRektBoy724/BetterXencrypt

A better version of Xencrypt.Xencrypt it self is a Powershell runtime crypter designed to evade AVs.

Language: PowerShell - Size: 99.6 KB - Last synced at: over 1 year ago - Pushed at: almost 4 years ago - Stars: 200 - Forks: 46

DragonRaaS/Dragon-Ransomware

New Ransomware bypassing EDR, AVs, UAC, Sandboxes.

Language: C# - Size: 1.95 KB - Last synced at: over 1 year ago - Pushed at: over 1 year ago - Stars: 1 - Forks: 0

loadenmb/tvasion

:performing_arts: Anti virus evasion based on file signature change via AES encryption with Powershell and C# AV evasion templates which support executable and Powershell payloads with Windows executable, Powershell or batch output. Developed with Powershell on Linux for Windows targets :)

Language: PowerShell - Size: 137 KB - Last synced at: over 1 year ago - Pushed at: over 5 years ago - Stars: 75 - Forks: 28

giacomoarienti/cybersec-blog

A cybersecurity related blog

Language: Ruby - Size: 80.1 KB - Last synced at: over 1 year ago - Pushed at: over 2 years ago - Stars: 0 - Forks: 0

FreeLesio/Rubber-Ducky-Reverse-Shell

Fast & Silent Script For Rubber Ducky To Inject Reverse Shell

Size: 37.1 KB - Last synced at: almost 2 years ago - Pushed at: over 3 years ago - Stars: 15 - Forks: 3

bobby-tablez/Heuristic-Confuser

Sandbox/Heuristic PowerShell Bypass

Language: PowerShell - Size: 3.91 KB - Last synced at: almost 2 years ago - Pushed at: about 2 years ago - Stars: 2 - Forks: 0

ChimesOfDestruction/Crypters-Source-Collection

SRC Collection: Autoit, Delphi, .NET, VB6, C++ and more.

Size: 150 MB - Last synced at: about 2 years ago - Pushed at: about 2 years ago - Stars: 1 - Forks: 0

vxlabinfo/SignFinder

Tool for easy clean PE32 from AV signature

Language: Python - Size: 13.7 KB - Last synced at: about 2 years ago - Pushed at: over 8 years ago - Stars: 27 - Forks: 11

padovah4ck/RedSharp

Penetration Test / Read Team - C# tools repository

Language: C# - Size: 151 KB - Last synced at: about 2 years ago - Pushed at: over 3 years ago - Stars: 50 - Forks: 20

tid4l/TallGrass

An AV exclusion enumeration tool written in Python.

Language: Python - Size: 78.1 KB - Last synced at: about 2 years ago - Pushed at: about 3 years ago - Stars: 61 - Forks: 6

GetRektBoy724/TripleS

Extracting Syscall Stub, Modernized

Language: C# - Size: 75.2 KB - Last synced at: about 2 years ago - Pushed at: about 3 years ago - Stars: 51 - Forks: 17

MFernstrom/Blowfish-Base64

Desktop tool to encrypt a string with Blowfish and Base64 encode the result

Language: Pascal - Size: 573 KB - Last synced at: 8 days ago - Pushed at: almost 3 years ago - Stars: 2 - Forks: 1

redteam88/KillDefenderBOF Fork of Cerbersec/KillDefenderBOF

Beacon Object File PoC implementation of KillDefender

Language: C - Size: 99.6 KB - Last synced at: about 2 years ago - Pushed at: about 3 years ago - Stars: 7 - Forks: 1

enascimento/gym-malware Fork of endgameinc/gym-malware

This is a malware manipulation environment for OpenAI's gym

Language: Python - Size: 567 KB - Last synced at: almost 2 years ago - Pushed at: over 7 years ago - Stars: 3 - Forks: 0