xxl-job内存马

An open-source, C#-based remote administration tool (RAT), enabling complete control of a remote Windows machine, designed for legitimate remote administration and security testing of Windows systems.

IronPE is a Windows PE manual loader written in Rust for both x86 and x64 PE files.

execute PE in memory Filelessly

A C# PE loader for x64 and x86 PE files.

Elfina is a multi-architecture ELF loader written in Rust, supporting x86 and x86-64 binaries.

Plaguards: Open Source PowerShell Deobfuscation and IOC Detection Engine for Blue Teams. [Presented at Black Hat Asia and USA 2025 Arsenal]

Origami Crypter with an updated version of the stub that bypasses windows defender.

Ghost-C2 is a command-and-control framework written entirely in pure x64 Linux Assembly with no libc dependencies. Every operation goes through direct syscalls. There are no import tables, no dynamic linker artifacts, and no disk writes. The C2 channel runs over raw ICMP sockets, hiding inside standard diagnostic traffic.

Awesome Fileless Malware Scientific Research

Selling crypter / crypter services bypassing windows defender. Private stub for each purchase. 50 dollars.

Awesome Fileless Malware

Proof of Concept que replica la técnica de evasión avanzada utilizada por APT35 (Charming Kitten) en su backdoor "PowerLess" (2021-2022).

Fileless Persistence Engine -- 7 techniques that survive reboot without writing a single file to disk. Pure Go.

For educational and cybersecurity purposes.

Fileless Malware Cookbook

PowerShell benchmark and robust LOTL/fileless detection artifact with v9 and v10 evaluation outputs.

This case, centered on a PowerShell download cradle, illustrates one of the most common but under-analyzed threats in modern enterprise environments.

This is a lightweight Command and Control (C2) tool built with Rust, featuring a minimal set of core functionalities

Fetch a remote C# Assembly and execute it in memory using Assembly.Load