مشاريع AbdouRoumi

MalwareEvasionTechniques

abdouroumi/malwareevasiontechniques

Research project showcasing various malware evasion techniques used to bypass AVs and EDRs, continuously updated with new methods.

Early_Bird_APC_Injection

abdouroumi/early_bird_apc_injection

Code injection via Asynchronous Procedure Calls to bypass Windows defenses. Mapped to MITRE ATT&CK T1055.004.(Process Injection: Asynchronous Procedure Call).

R0m4NTAPI

abdouroumi/r0m4ntapi

Native API injector

PE_Inspector

abdouroumi/pe_inspector

A powerful PE file inspector for analyzing Portable Executable binaries, providing detailed insights into their structure, headers, and properties

GpuAbuser-Malware

abdouroumi/gpuabuser-malware

Research in progress: A malware that abuses the GPU to accelerate the decryption process.

Local-And-Remote_Function_Stomping

abdouroumi/local-and-remote_function_stomping

Function Stomping (MITRE ATT&CK ID: T1055.012) — Advanced injection technique overwriting legitimate functions with custom payloads to evade detection. Research & Educational purposes only

Custom-GetModuleHandle

abdouroumi/custom-getmodulehandle

A custom implementation of GetModuleHandle, often used in malware to evade detection by bypassing standard API resolution methods

Remote_Process_Injection

abdouroumi/remote_process_injection

This is a malware that i used in it remote process injection technique, it scans for processes chooses the one you named and inject shellcode in it

Custom-GetProcAddress

abdouroumi/custom-getprocaddress

A custom implementation of GetProcAddress, often used in malware to evade detection by bypassing standard API resolution methods

Api_Hashing

abdouroumi/api_hashing

Implements dynamic Windows API resolution via hashing techniques to evade detection. Inspired by techniques mapped to MITRE ATT&CK T1055.012 (Process Injection: API Access).

NTAPI_Anti-Debugging_Checker_and_Patcher

abdouroumi/ntapi_anti-debugging_checker_and_patcher

NTAPI Anti-Debugging Checker and Patcher is a Windows-based tool designed for research purposes, demonstrating how to detect and manipulate anti-debugging techniques in running processes using NTAPI functions. The tool allows users to retrieve and modify specific PEB (Process Environment Block) values, particularly the BeingDebugged flag.

WebStagingMalware

abdouroumi/webstagingmalware

This is an application for both MalwareScanner and MalwareStaging

Mapping_Injector

abdouroumi/mapping_injector

This is a repo that contains 2 techniques : Local mapping injection and Remote injection technique , MITRE ID T1055

Payload_Execution_Control

abdouroumi/payload_execution_control

A repository showcasing payload execution control using mutexes, semaphores, and events in Windows, for educational purposes.

RegistryStagingMalware

abdouroumi/registrystagingmalware

This Malware is an application for MalwareEvasionTechniques repo .I used in it Registery staging in two modes R/W and I combined it with the remote scanner

ProcessHacker-Argument-Spoofer

abdouroumi/processhacker-argument-spoofer

Malware evasion technique by manipulating process command-line arguments to hide the actual executed payload, used to evade the manual detection of ProcessHacker and ProcessExplorer. MITRE ATT&CK ID: T1036.005 (Masquerading: Match Legitimate Name or Location).

Hasherama

abdouroumi/hasherama

A Windows string hashing toolkit for security research and malware analysis.Research implementation of malware-focused algorithms from VX Underground collection. For educational and research purposes only.

Procmon-Process-Argument-Spoofer

abdouroumi/procmon-process-argument-spoofer

Malware evasion technique by manipulating process command-line arguments to hide the actual executed payload, commonly used to evade Windows monitoring tools. MITRE ATT&CK ID: T1036.005 (Masquerading: Match Legitimate Name or Location).

RemoteThreadHijacking

abdouroumi/remotethreadhijacking

This is a malware that i used in it remote thread hijacking

JustCry

abdouroumi/justcry

This is a challenge made for NexTrace CTF, Malware Analysis case

Parent-PID-Spoofing

abdouroumi/parent-pid-spoofing

This is a repo that contains an implementation of Parent PID spoofing evasion technique, MITRE ID T1036

Maldev_Evasion_prevails

abdouroumi/maldev_evasion_prevails

This is a repo of Malware Developement Workshop that I hosted with Nexus Security Club, it contains the modules and also the slides. If you are beginner in MalDev you can check the content to learn some new stuff