|
fileless malware
Hi all
fileless malware are on the rise (see latest Duqu), because thanks to some powershell tricks anyone can write them easily. The learning curve for a fileless malware is now extremely low.
In the past you had to, at least, implement a dll-in-memory loader (I wrote one tutorial about this few years ago, you can find it around "Loading_a_DLL_from_memory_Shub-Nigurrath_v12.rar").
Duqu rise: https://www.schneier.com/blog/archives/2017/02/duqu_malware_te.html
Some frameworks to create similar payloads ...
https://github.com/Genetic-Malware/Ebowla it's a Framework for making Environmental Keyed Payload with reflective DLL, ShellCode, Powershell..
https://github.com/byt3bl33d3r/CrackMapExec its an Opsec safe for pentesting Windows/Active Directory environment ..
https://github.com/n1nj4sec/pupy a RAT written in Python then cross-platform, with a very low footprint
https://github.com/EmpireProject simply a Powershell post-exploitation agent.
Shub
__________________
Ŝħůb-Ňìĝùŕřaŧħ ₪)
There are only 10 types of people in the world: Those who understand binary, and those who don't
http://www.accessroot.com
|