All Projects → aaaddress1 → Skrull

aaaddress1 / Skrull

Licence: Apache-2.0 license
Skrull is a malware DRM, that prevents Automatic Sample Submission by AV/EDR and Signature Scanning from Kernel. It generates launchers that can run malware on the victim using the Process Ghosting technique. Also, launchers are totally anti-copy and naturally broken when got submitted.

Programming Languages

c
50402 projects - #5 most used programming language
C++
36643 projects - #6 most used programming language

Projects that are alternatives of or similar to Skrull

MsfMania
Python AV Evasion Tools
Stars: ✭ 388 (-6.05%)
Mutual labels:  injection, bypass-antivirus
cosyTabs
SIMBL plug-in for Safari. Now with macOS Sierra/Safari 10 support. Small tabs like they used to be back in the day.
Stars: ✭ 44 (-89.35%)
Mutual labels:  injection
Injectioniii
Re-write of Injection for Xcode in (mostly) Swift
Stars: ✭ 2,680 (+548.91%)
Mutual labels:  injection
Kodein Di
Painless Kotlin Dependency Injection
Stars: ✭ 2,692 (+551.82%)
Mutual labels:  injection
Httpcanary
A powerful capture and injection tool for the Android platform
Stars: ✭ 2,188 (+429.78%)
Mutual labels:  injection
di
🐑 A flexible dependency injection container; It is an implementation of PSR-11
Stars: ✭ 20 (-95.16%)
Mutual labels:  injection
Invoker
Penetration testing utility, and antivirus assessment tool.
Stars: ✭ 178 (-56.9%)
Mutual labels:  injection
moneta
Moneta is a live usermode memory analysis tool for Windows with the capability to detect malware IOCs
Stars: ✭ 384 (-7.02%)
Mutual labels:  injection
gr-eventstream
gr-eventstream is a set of GNU Radio blocks for creating precisely timed events and either inserting them into, or extracting them from normal data-streams precisely. It allows for the definition of high speed time-synchronous c++ burst event handlers, as well as bridging to standard GNU Radio Async PDU messages with precise timing easily.
Stars: ✭ 38 (-90.8%)
Mutual labels:  injection
Airpwn Ng
airpwn-ng
Stars: ✭ 231 (-44.07%)
Mutual labels:  injection
Intruderpayloads
A collection of Burpsuite Intruder payloads, BurpBounty payloads, fuzz lists, malicious file uploads and web pentesting methodologies and checklists.
Stars: ✭ 2,779 (+572.88%)
Mutual labels:  injection
Brouter
Stars: ✭ 198 (-52.06%)
Mutual labels:  injection
Kernel-dll-injector
Kernel-Mode Driver that loads a dll into every new created process that loads kernel32.dll module
Stars: ✭ 256 (-38.01%)
Mutual labels:  injection
Hrshell
HRShell is an HTTPS/HTTP reverse shell built with flask. It is an advanced C2 server with many features & capabilities.
Stars: ✭ 193 (-53.27%)
Mutual labels:  injection
DInvoke shellcodeload CSharp
ShellCodeLoader via DInvoke
Stars: ✭ 41 (-90.07%)
Mutual labels:  bypass-antivirus
Twitterx
Keeping Twitter for macOS alive with code injection
Stars: ✭ 187 (-54.72%)
Mutual labels:  injection
Lime Crypter
Simple obfuscation tool
Stars: ✭ 217 (-47.46%)
Mutual labels:  injection
NativePayload CBT
NativePayload_CallBackTechniques C# Codes (Code Execution via Callback Functions Technique, without CreateThread Native API)
Stars: ✭ 109 (-73.61%)
Mutual labels:  bypass-antivirus
typeioc
Dependency injection container for typescript / javascript
Stars: ✭ 32 (-92.25%)
Mutual labels:  injection
CEH
Exam Prep for the Ec-council Certified Ethical Hacker 312-50
Stars: ✭ 71 (-82.81%)
Mutual labels:  injection

Skrull

Skrull is a malware DRM, that prevents Automatic Sample Submission by AV/EDR and Signature Scanning from Kernel. It generates launchers that can run malware on the victim using the Process Ghosting technique. Also, launchers are totally anti-copy and naturally broken when got submitted.

It's a proof-of-concept of the talk of ROOTCON & HITCON 2021, check out Skrull Like A King: From File Unlink to Persistence and Skrull Like A King:從重兵看守的天眼防線殺出重圍 :)

note that currently support only x64 PE now, due to the ghosting technique.

Video Demo

Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].