Malware

General

Read: uncategorized.

• awesome-malware-analysis
• awesome-malware-development
• vxunderground - Malware Source Code
• vxunderground - Linux Papers
• vxunderground - Windows Papers
• Malware Hell
  • Malware analysis blog
• hasherezade | GitHub
  • Malware dev/analysis
• GEF
  • GDB with more modern/advanced features
• al-khaser
  • Public malware techniques used in the wild
• warp
  • Create self-contained binary applications
• DTrace
  • Dynamic tracing framework
• imphash
  • Hash over the imported functions by PE file
• CS6038/CS5138 Malware Analysis, UC
• CTI-fundamentals
• Windows System Programming Experiments
  • Lots of useful snippets
• TamperingSyscalls
  • TODO: Explanation
• ofrak
  • Unpack, modify, then repack binaries
• ev
  • IDS evasion via packet manipulation
• FunctionStomping
  • TODO: Link to resource
• malapi.io
  • Search syscalls for usage in malware
• Windows System Calls for Hunters
• pe-bear
  • Platform for reversing PE files
• LockBit-Black-Builder
  • Leaked builder for LockBit 3.0
• massayo
  • Rust library for removing AV/EDR hooks in a given system DLL
• LimeLighter
  • Spoof code signing certs, sign binaries + DLLs
• Living-Off-the-Blindspot - Operating into EDRs' blindspot
  • Final product: Pyramid
• Invoke-DLLClone
• SharpDPAPI
  • C# port of some Mimikatz DPAPI functionality
• A TECHNICAL ANALYSIS OF PEGASUS FOR ANDROID - PART 1
• New SHC-compiled Linux malware installs cryptominers, DDoS bots
  • Usage of compiled shell scripts in the wild with shc
• Hackers hijack Linux devices using PRoot isolated filesystems
  • Original: Discovered new BYOF technique to cryptomining with PRoot
  • Malware that uses proot, a userland chroot + bind mount, in order to transport/deploy its toolset
• A technique for ELF file infection
  • Part 2
  • Part 3
• shellter
  • Dynamic shellcode injector/PE infector
  • 32-bit only! (free version only?)
• Bypass Antivirus Dynamic Analysis
  • Limitations of the AV model and how to exploit them
• angr
  • Python library for binary analysis
• Injection into a Process Using KnownDlls
  • TODO: Update this link: https://papers.vx-underground.org/papers/Windows/Process%20Injection/2019-08-12%20-%20Windows%20Process%20Injection%20via%20KnownDlls%20Cache%20Poisoning.pdf
  • Also see: How loader Maps DLL in to Process Address Space
• sandbox-attacksurface-analysis-tools
  • Set of tools to analyze Windows sandboxes for exposed attack surface
  • TODO: Can't remember how or why this is useful... It's from James Forshaw, so maybe I found it in a Google Zero blogpost? Idk.
• Windows Code Injection: Bypassing CIG Through KnownDLLs
  • James Forshaw's take on KnownDLLs
  • Reference in VXUG paper?

Development

• VX-API
  • Helpers to aid in malware dev
• OffensiveNim
• OffensiveAutoIt
• OffensiveRust
• OffensiveCSharp
• OffensiveVBA
• Black Hat Rust
  • His blog is pretty handy too: kerkour.com