10 open source projects by countercept

A python2 script for processing a PCAP file to decrypt C2 traffic sent to DOUBLEPULSAR implant

snake - a malware storage zoo

A utility to use the usermode shellcode from the DOUBLEPULSAR payload to reflectively load an arbitrary DLL into another process, for use in testing detection techniques or other security research.

Scripts for performing and detecting parent PID spoofing

A python2 script for sweeping a network to find windows systems compromised with the DOUBLEPULSAR implant.

A helper script for unpacking and decompiling EXEs compiled from python code.

Rapidly Search and Hunt through Windows Event Logs

A collection of useful radare2 scripts!

A spiritual .NET equivalent to the Gargoyle memory scanning evasion technique

https://blog.f-secure.com/hiding-malicious-code-with-module-stomping/