🌟 REMCOS RAT🌟

⬇️ Download

bugcod3

#rat #windows #malware
➗➗➗➗➗➗➗➗➗➗➗➗
🔥 0Day.Today
👤 T.me/LearnExploit
📢 T.me/Tech_Army

👻 Ghost 👻

👻 RAT (Remote Access Trojan) - Silent Botnet - Full Remote Command-Line Access - Download & Execute Programs - Spread Virus' & Malware

💬
ghost is a light RAT that gives the server/attacker full remote access to the user's command-line interpreter (cmd.exe). They are allowed to execute commands silently without the client/zombie noticing. The server/attacker is also given the ability to download and execute files on the client/zombie's computer. This is also a silent and hidden process. Like most Remote Access Trojans, this download and execution ability helps distribute viruses and other pieces of malware.

👁‍🗨
This malware is distributed simply by running zombie.exe. This file name can be changed to whatever. There is no restriction. When run, it searches for the first two arguments (IP & Port). If neither is provided, the program doesn't run. With that being said, make sure you provide the server's IP and Port in the command-line arguments. Example:

zombie.exe 127.0.0.1 27015

📊 Features:
⚪️ Remote command execution
⚪️ Silent background process
⚪️ Download and run file (Hidden)
⚪️ Safe Mode startup
⚪️ Will automatically connect to the server
⚪️ Data sent and received is encrypted (substitution cipher)
⚪️ Files are hidden
⚪️ Installed Antivirus shown to server
⚪️ Easily spread malware through download feature
⚪️ Startup info doesn't show in msconfig or other startup checking programs like CCleaner
⚪️ Disable Task Manager

😸 Github

⬇️ Download
🔒 BugCod3

#Rat #Malware #Remote #Access
➖➖➖➖➖➖➖➖➖➖
🔥 0Day.Today
📣 T.me/LearnExploit

CrimsonEDR

💬
CrimsonEDR is an open-source project engineered to identify specific malware patterns, offering a tool for honing skills in circumventing Endpoint Detection and Response (EDR). By leveraging diverse detection methods, it empowers users to deepen their understanding of security evasion tactics.

🔼 Installation:
⚪️ Install dependancy:
sudo apt-get install gcc-mingw-w64-x86-64
⚪️ Download repository
⚪️ Compile the project:
cd CrimsonEDR;
chmod +x compile.sh;
./compile.sh

⚠️ Warning:
Windows Defender and other antivirus programs may flag the DLL as malicious due to its content containing bytes used to verify if the AMSI has been patched. Please ensure to whitelist the DLL or disable your antivirus temporarily when using CrimsonEDR to avoid any interruptions.

💻 Example:
.\CrimsonEDRPanel.exe -d C:\Temp\CrimsonEDR.dll -p 1234

😸 Github

⬇️ Download
🔒 LearnExploit

#C #Simulate #Malware #Dev
➖➖➖➖➖➖➖➖➖➖
📣 T.me/BugCod3
📣 T.me/LearnExploit

RWX_MEMEORY_HUNT_AND_INJECTION_DV

💬
Abusing Windows fork API and OneDrive.exe process to inject the malicious shellcode without allocating new RWX memory region. This technique is finding RWX region in already running processes in this case OneDrive.exe and Write shellcode into that region and execute it without calling CreateRemoteThread, NtCreateRemoteThread or Direct calls.

💻 Usage:
Just compile the program and run the (EXE) without any paremeter.

💡 Steps:
⚪️ Find the OneDrive.exe in running processes.
⚪️ Get the handle of OneDrive.exe.
⚪️ Query remote process memory information.
⚪️ look for RWX memory regions.
⚪️ Write shellcode into found region of OneDrive.exe
⚪️ Fork OneDrive.exe into a new process.
⚪️ Set the forked process's start address to the cloned shellcode.
⚪️ Terminate the cloned process after execution

▶ DEMO

😸 Github

⬇️ Download
🔒 A3l3_KA4

#ShellCode #Malware
➖➖➖➖➖➖➖➖➖➖
📣 T.me/BugCod3
📣 T.me/LearnExploit
📣 T.me/A3l3_KA4