xxl-job内存马

An open-source, C#-based remote administration tool (RAT), enabling complete control of a remote Windows machine, designed for legitimate remote administration and security testing of Windows systems.

IronPE is a Windows PE manual loader written in Rust for both x86 and x64 PE files.

execute PE in memory Filelessly

A C# PE loader for x64 and x86 PE files.

Elfina is a multi-architecture ELF loader written in Rust, supporting x86 and x86-64 binaries.

A fileless C2 framework written in pure x64 Linux Assembly with zero libc dependencies. Features dynamic protocol pivoting between raw ICMP sockets and DNS (UDP/53) via in-memory VTable manipulation. 100% direct syscalls, no disk writes, and strict mathematical packet authentication.

Plaguards: Open Source PowerShell Deobfuscation and IOC Detection Engine for Blue Teams. [Presented at Black Hat Asia and USA 2025 Arsenal]

Origami Crypter with an updated version of the stub that bypasses windows defender.

Awesome Fileless Malware Scientific Research

Selling crypter / crypter services bypassing windows defender. Private stub for each purchase. 50 dollars.

Awesome Fileless Malware

Proof of Concept que replica la técnica de evasión avanzada utilizada por APT35 (Charming Kitten) en su backdoor "PowerLess" (2021-2022).

Fileless Persistence Engine -- 7 techniques that survive reboot without writing a single file to disk. Pure Go.

For educational and cybersecurity purposes.

Fileless Malware Cookbook

This case, centered on a PowerShell download cradle, illustrates one of the most common but under-analyzed threats in modern enterprise environments.

PowerShell benchmark and robust LOTL/fileless detection artifact with v9 and v10 evaluation outputs.

Digital forensics tool to detect and snapshot malware file events during dynamic analysis. Catch malware creating/deleting files.

Linux In-Memory ELF Loader -- Execute binaries from memory via memfd_create, /proc/self/mem, shm_open. Zero disk artifacts. Bash + Python.