peta909

Malware Researcher, always hoping to learn more and share knowledge with others.

Singapore

Pinned Repositories

Atom_bombing
Commented version of Atom_bombing injection technique. Original source code from https://blog.ensilo.com/atombombing-brand-new-code-injection-for-windows
Language:C++2 1 02
Carberp
Carberp Banking Trojan
Language:C++1 0 00
CreateProcess
A simple C++ app to demo the use of CreateProcess() ,WaitForSingleObject() and use of handles.
Language:C++3 1 00
DanSpecial
Weaponizing Gigabyte driver for priv escalation and bypass PPL
Language:C1 1 00
DrvMon
Advanced driver monitoring utility.
Language:C1 0 00
FileTest
Source code for File Test - Interactive File System Test Tool
Language:C++1 1 00
malware-source-nanomites
Language:Assembly1 1 00
NtCreateUserProcess_
Language:C12 3 24

peta909's Repositories

peta909/DrvMon
Advanced driver monitoring utility.
Language:C1 0 00
peta909/VB2024_MCE_WorkShop
Materials required for VB2024 MCE Workshop
Language:Python1
peta909/vxlang-page
protector & obfuscator & code virtualizer
Language:C++1 0 0
peta909/BlackLotus
BlackLotus UEFI Windows Bootkit
peta909/config_extractors
Configuration extractors/decryptors for various Windows malware families.
Language:Python0 0
peta909/Configuration_extractors
Configuration Extractors for Malware
Language:Python0 0
peta909/d810
peta909/dnlib
Reads and writes .NET assemblies and modules
Language:C#0 0
peta909/donut-decryptor
Retrieve inner payloads from Donut samples
Language:Python0 0
peta909/finspy_devirtualizer
Language:Python0 0
peta909/FullBypass
A tool which bypasses AMSI (AntiMalware Scan Interface) and PowerShell CLM (Constrained Language Mode) and gives you a FullLanguage PowerShell reverse shell. Feel free to modiy and DM if you find some bugs :)
Language:C#0 0
peta909/GootUnloader
GootUnloader — Unpack GootLoader with Frida
Language:Python0 0
peta909/ipyida
IPython console integration for IDA Pro
peta909/KDU
Kernel Driver Utility
peta909/Kernel_Driver_writing_Tutorial
Recon 2023 slides and code
peta909/MalwareAnalysisReports
Reports in .MD format
Language:Jupyter Notebook0 0
peta909/Nidhogg
Nidhogg is an all-in-one simple to use rootkit for red teams.
Language:C++0 0
peta909/obfus.h
Macro-header for compile-time C obfuscation (tcc, win x86/x64)
peta909/Parasite-Invoke
Hide your P/Invoke signatures through other people's signed assemblies
Language:C#0 0
peta909/PoolParty
A set of fully-undetectable process injection techniques abusing Windows Thread Pools
peta909/python-xdis
Python cross-version bytecode library and disassembler
peta909/Quasar
Remote Administration Tool for Windows
Language:C#0 0
peta909/Rapid7-Labs
Rapid7 Labs operates as the division of Rapid7 focused on threat research. It is renowned for providing comprehensive threat intelligence, research and analytics.
Language:YARA0 0
peta909/rat_king_parser
A robust, multiprocessing-capable, multi-family RAT config parser/config extractor for AsyncRAT, DcRAT, VenomRAT, QuasarRAT, and cloned/derivative RAT families.
Language:Python0 0
peta909/RATDecoders
Python Decoders for Common Remote Access Trojans
Language:Python0 0
peta909/rust-re-tour
A tour of what some Rust language features look like after compilation.
Language:Rust0 0
peta909/sharem
SHAREM is a shellcode analysis framework, capable of emulating more than 12,000 WinAPIs and virutally all Windows syscalls. It also contains its own custom disassembler, with many innovative features, such as being able to show the deobfuscated disassembly of an encoded shellcode, or integrating emulation data to enhance the disassembly.
Language:Python0 0
peta909/TCSA
Language:Python0 0
peta909/VMProtect-Source
Source of VMProtect (NOT OFFICIALLY)
Language:C++0 0
peta909/WubbabooMark
Debugger Anti-Detection Benchmark
Language:C0 0