Local-PE-Injection LocalPE-Injection.c /* PE Injection Steps: 1. Allocate memory to hold injected PE file. 2. Copy over the PE sections to the allocated memory 3. Address the PE relocation...

Domain-KillSwitch domain-killswitch.c #include <Windows.h> #include <stdio.h> #include <windns.h> #pragma comment(lib, "dnsapi.lib") /* Checks whether a domain resolves via...

Peristence-Windows-Registry main.c /* Run / RunOnce registry keys are well known to be used by legitimate software. - Run registry -> Executes everytime the user logs on - RunOnce...

MetaData-Modification demo.c #include <stdio.h> int main() { printf("[+] This is Metadata Modification Demo"); }

DRM-Equipped-Malware drm.c /* - Digital Rights Management, the malware will modify itself to ensure that is exclusively executes on the target machine. - DRM Logic: 1. The malware runs for t...

NTDLL-Unhooking-SuspendedProcess NTDLL-Unhooking-Suspended-Process.c #include <Windows.h> #include <stdio.h> #include <winternl.h> // Retrieve base address ntdll.dll image PVOI...

MalDevEdr Console.c #include <Windows.h> #include <stdio.h> #include "Common.h" // if injecting the dll into a cli process // if not, then comment it: #define TARGET_CLI_PROCESSES...

ApcInjection main.c // @NUL0x4C | @mrd0x : MalDevAcademy #include <Windows.h> #include <stdio.h> // if the following is defined, the code will run apc injection using a alertable s...

Anti-Analysis Techniques Techniques.c #include <Windows.h> #include <stdio.h> #include <Shlwapi.h> #include <Psapi.h> #pragma comment(lib, "Shlwapi.lib") // Detect VM b...

EarlyBird-Injection main.rs use std::{ ffi::CString, io::{self, Write}, ptr::null_mut, }; use winapi::{ ctypes::c_void, um::{ debugapi::DebugActiveProcessStop, ...