schrodyn

memberref2yara

Dump .NET MemberRef Table as a Yara Rule

EazFixer

A deobfuscation tool for Eazfuscator.

malwares-collection

Collection of Virii - Worms - Trojan

threat-research

Repository of tools, YARA rules, and code-snippets from Stairwell's research team.

Antivirus-Artifacts

Anti-virus artifacts. Listing APIs hooked by: Avira, BitDefender, F-Secure, MalwareBytes, Norton, TrendMicro, and WebRoot.

boobsnail

BoobSnail allows generating Excel 4.0 XLM macro. Its purpose is to support the RedTeam and BlueTeam in XLM macro generation.

Challenge-Solution-Files

Solution scripts and other misc stuff referenced in writeups on my blog : https://mrt4ntr4.github.io/

charlotte

c++ fully undetected shellcode launcher ;)

Cobalt-Wipe

Cobalt wipe is the non-commercial version of Cobalt-Strike 4.3 (May 2021 Release)

CVE-2021-1675

Impacket implementation of CVE-2021-1675

exploits-2

Godzilla

哥斯拉

ioc

Threat Intel IoCs + bits and pieces of dark matter

Koadic-C3-guide

MetadataLocator

Locate the address of .NET metadata by CLR to anti anti dump

NGLite

A major platform RAT Tool based by Blockchain/P2P.Now support Windows/Linux/MacOS

proxyshell_payload

proxyshell payload generate

python-ipp

Asynchronous Python client for Internet Printing Protocol (IPP)

r2con2021_deobfuscation

Workshop Material on VM-based Deobfuscation

ScatterBee_Analysis

Scripts to aid analysis of files obfuscated with ScatterBee.

section-obfuscation

PE Header (.rdata,.data,.text) obsfucation

shiro_rce_tool

shiro rce tool 反序列 命令执行 一键工具 回显

Sildes

Slides from Public Talks

stage3

SuperMem

A python script developed to process Windows memory images based on triage type.

temp

VmwareHardenedLoader

Vmware Hardened VM detection mitigation loader (anti anti-vm)

writeups

yara

The pattern matching swiss knife

yara_rules_for_carbonblack_response

Public yara rules carbonblack response for yara connector