xxl-job内存马

An open-source, C#-based remote administration tool (RAT), enabling complete control of a remote Windows machine, designed for legitimate remote administration and security testing of Windows systems.

execute PE in memory Filelessly

A C# PE loader for x64 and x86 PE files.

Plaguards: Open Source PowerShell Deobfuscation and IOC Detection Engine for Blue Teams. [Presented at Black Hat Asia and USA 2025 Arsenal]

Origami Crypter with an updated version of the stub that bypasses windows defender.

Selling crypter / crypter services bypassing windows defender. Private stub for each purchase. 50 dollars.

Awesome Fileless Malware Scientific Research

Proof of Concept que replica la técnica de evasión avanzada utilizada por APT35 (Charming Kitten) en su backdoor "PowerLess" (2021-2022).

For educational and cybersecurity purposes.

Awesome Fileless Malware

Digital forensics tool to detect and snapshot malware file events during dynamic analysis. Catch malware creating/deleting files.

This case, centered on a PowerShell download cradle, illustrates one of the most common but under-analyzed threats in modern enterprise environments.

Fetch a remote C# Assembly and execute it in memory using Assembly.Load

🧪 Explore malware samples to understand how Trojans, spyware, ransomware, and more operate in a controlled environment for research and learning.

This is a lightweight Command and Control (C2) tool built with Rust, featuring a minimal set of core functionalities

🔍 Load x86 and x64 PE files with ease using this C# console application, ideal for fileless execution methods and efficient memory management.