Speakeasy is a portable, modular, binary emulator designed to emulate Windows kernel and user mode malware

Code: https://github.com/fireeye/speakeasy
Article: https://www.fireeye.com/blog/threat-research/2020/08/emulation-of-malicious-shellcode-with-speakeasy.html

#reverse #malware #dukeBarman

How To Reverse Engineer RC4 Crypto For Malware Analysis https://www.youtube.com/watch?v=-EQKiIbOLEc #reverse #malware #ghidra #dukeBarman

VM Detection Tricks, Part 1: Physical memory resource maps

In this series we’ll document a novel and as-yet-undocumented Virtual Machine detection trick for each month of 2021. These detection tricks will be focused on 64-bit Windows 10 or Windows Server 2019 guests, targeting a variety of VM platforms.

https://labs.nettitude.com/blog/vm-detection-tricks-part-1-physical-memory-resource-maps/

#reverse #detect #vm #malware #redteam #darw1n

Anti-virus artifacts. Listing APIs hooked by: Avira, BitDefender, F-Secure, MalwareBytes, Norton, TrendMicro, and WebRoot.

https://github.com/D3VI5H4/Antivirus-Artifacts

#malware #av #redteam #artifacts #darw1n

Free Malware Analysis training. Volume 1 via hasherezade https://github.com/hasherezade/malware_training_vol1 (in progress) #reverse #malware #dukeBarman

FIN7: Lizar toolkit architecture

https://bi-zone.medium.com/from-pentest-to-apt-attack-cybercriminal-group-fin7-disguises-its-malware-as-an-ethical-hackers-c23c9a75e319

#malware #analysis #darw1n

The Cross Platform AutoIt Extractor

https://github.com/x0r19x91/UnAutoIt

#tools #malware #extract #autoit #darw1n

Nim implementation of Process Hollowing using syscalls (for educational purposes)

https://github.com/snovvcrash/NimHollow

#malware #redteam #processhollowing #inject #darw1n

Anubis Android Malware Analysis / Source Code https://forum.reverse4you.org/t/anubis-android-malware-analysis/16982 #reverse #mobile #malware #anroid #anubis #analysis #darw1n

JavaScript Deobfuscator and Unpacker https://forum.reverse4you.org/t/javascript-deobfuscator-and-unpacker/16986 #tools #malware #javascript #unpack #obfuscation #darw1n

SleepyCrypt: Encrypting a running PE image while it sleeps

https://forum.reverse4you.org/t/sleepycrypt-encrypting-a-running-pe-image-while-it-sleeps/17116

#malware #redteam #tips #encrypt #protection #windows #cobaltstrike #Octopus

Richkware a framework for building Windows malware, written in C++

https://forum.reverse4you.org/t/richkware-a-framework-for-building-windows-malware-written-in-c/17103

#tools #redteam #malware #framework #agent #Karina

HashDB is a free community-sourced library of hashing algorithms used in malware, with an IDA plugin!

⚙️API
https://hashdb.openanalysis.net/

🧩IDA Plugin
https://github.com/OALabs/hashdb-ida

👾 Add Custom Algorithms
https://github.com/OALabs/hashdb

#malware #idapro #plugin #hashlib #KosBeg

easy-kernelmapper: map your driver with a batch

Intro - https://www.unknowncheats.me/forum/anti-cheat-bypass/476567-easy-kernelmapper-map-driver-batch.html

Repo - https://github.com/0dayatday0/BattleFN-cheat-analysis

Analysis - https://github.com/0dayatday0/BattleFN-cheat-analysis/blob/main/cheat-analysis.pdf

#re #cheat #gamehack #malware #redteam #kernel #driver #0dayatday0

A Comprehensive Guide to Hooking Windows APIs with Python

https://forum.reverse4you.org/t/a-comprehensive-guide-to-hooking-windows-apis-with-python/18152

#reverse #malware #inject #hook #tips #darw1n

The FLARE Obfuscated String Solver (FLOSS) has been supporting analysts to extract hidden strings from malware samples for many years now. Over the last few months, we’ve added new functionality and improved the tool’s performance. In this blog post we will share exciting new features and improvements including a new string deobfuscation technique, simplified tool usage, and much faster result output.

https://www.mandiant.com/resources/floss-version-2

#malware #reverse #tools #SoGood0x1

Rusty Bootkit - Windows UEFI Bootkit in Rust (Codename: RedLotus)

https://github.com/memN0ps/bootkit-rs

#redteam #malware #bootkit #windows #rust

WindowsNoExec - Abusing existing instructions to executing arbitrary code without allocating executable memory

https://www.x86matthew.com/view_post?id=windows_no_exec

#windows #ctf #malware #tips

Process Injection without R/W target memory and without creating a remote thread

https://github.com/Maff1t/InjectNtdllPOC

#windows #redteam #ctf #malware #tips

Centralized resource for listing and organizing known injection techniques and POCs

https://github.com/itaymigdal/awesome-injection

#redteam #malware #process #inject