Malware Analysis 1 - Creating a PE parser, Shannon Entropy and more (Golang)

Introduction Hello hackers! Today we’ll be creating a CLI tool to analyze and extract PE files information as much as possible using github.com/Binject/debug/pe package. Explanation Parsing P...

Apr 11, 2023 Malware Analysis

Malware Development 7 - Persistence via autorun registry (Golang)

Introduction Hello my friends! This post will be a little bit shorter than usual but don’t worry because it will teach you a simple and well known persistence technique. Explanation A lot of ...

Mar 31, 2023 Malware Development

Malware Development 6 - Analysis evasion via anti-sandboxing tricks (Golang)

Introduction Hello hackers! In this post we’ll discuss some of the main anti-sandboxing tricks and techniques to avoid malware analysis and sandboxing. Then we’ll write a Golang program based o...

Mar 29, 2023 Malware Development

Malware Development 5 - Malware analysis evasion via Api Hashing (Golang)

Introduction Hello hackers! Today we’re going to see how real malware protect themselves from being analyzed using a technique called Api Hashing. Explanation First of all we should know what...

Mar 27, 2023 Malware Development

Malware Development 4 - Dump lsass.exe process + AV/EDR evasion (Golang)

Introduction Hello dear hackers! Today we’ll dump LSASS.EXE process memory to obtain credentials and we also will be using some evasion techniques. Inspired by Dumpert (an awesome tool) Explan...

Mar 24, 2023 Malware Development

Malware Development 3 - Persistence via Recycle Bin (Golang)

Introduction Hello dear hackers! Today we’re gonna see an effective technique to mantain access in Windows systems during red team operations just by modifying a registry key which interacts wi...

Mar 13, 2023 Malware Development

Malware Development 2 - UuidFromString shellcode injection (Golang)

Introduction Hello hackers! I’m D3Ext and today we’ll learn an advanced shellcode injection technique used by Lazarus group which uses UuidFromStringA API call Explanation In this demo we’ll ...

Mar 12, 2023 Malware Development

Malware Development 1 - CreateRemoteThread shellcode injection (Golang)

Introduction Hello hackers! Today we’re gonna see a simple malware development technique, Shellcode injection via CreateRemoteThread in Golang. The most complex malwares use different shellcode...

Mar 11, 2023 Malware Development

Malware Development 0 - How to call Windows API from Go

Introduction Hello friends! Today we’ll see how we can use Golang internal functions from syscall and golang.org/x/sys/windows packages to call Windows API. Other languages like C o C++ are spe...

Mar 9, 2023 Malware Development

AV Bypassing - Powershell Obfuscation

Introduction Hi there! In this post I am going to explain how we can bypass common AVs (antivirus) in different ways to help you during Red Team Operations and more. I recommend you to have a good...

Oct 14, 2022 Powershell

1
2
2 / 2