xxl-job内存马

A Remote Access Tool developed in C#, enabling complete control of a remote Windows machine, designed for legitimate remote administration and security testing of Windows systems.

execute PE in memory Filelessly

Plaguards: Open Source PowerShell Deobfuscation and IOC Detection Engine for Blue Teams. [Presented at Black Hat Asia and USA 2025 Arsenal]

Origami Crypter with an updated version of the stub that bypasses windows defender.

A C# PE loader for x64 and x86 PE files.

Selling crypter / crypter services bypassing windows defender. Private stub for each purchase. 50 dollars.

Awesome Fileless Malware Scientific Research

Proof of Concept que replica la técnica de evasión avanzada utilizada por APT35 (Charming Kitten) en su backdoor "PowerLess" (2021-2022).

For educational and cybersecurity purposes.

Awesome Fileless Malware

Digital forensics tool to detect and snapshot malware file events during dynamic analysis. Catch malware creating/deleting files.

This case, centered on a PowerShell download cradle, illustrates one of the most common but under-analyzed threats in modern enterprise environments.

🧪 Explore malware samples to understand how Trojans, spyware, ransomware, and more operate in a controlled environment for research and learning.

Fetch a remote C# Assembly and execute it in memory using Assembly.Load

This is a lightweight Command and Control (C2) tool built with Rust, featuring a minimal set of core functionalities