Giters

hasherezade / persistence_demos

Demos of various (also non standard) persistence methods used by malware

Repository from Github https://github.comhasherezade/persistence_demosRepository from Github https://github.comhasherezade/persistence_demos

persistence_demos

Build status

Demos for the presentation "Wicked malware persistence methods".

  • com_hijack - loads a demo DLL via COM hijacking
  • extension_hijack - hijacks extensions handlers in order to run a demo app while the file with the given extension is opened
  • shim_persist - installs a shim that injects a demo DLL into explorer.exe
  • restricted_directory - drops a PE into a restricted directory (that cannot be accessed or deleted), and launches it

About

Demos of various (also non standard) persistence methods used by malware

Languages

Language:C++ 89.1%Language:CMake 7.9%Language:C 2.8%Language:Batchfile 0.2%