AMSI36 Weaponized abuse of SYLK file format
SYLK is an ancient spreadsheet format, but Excel still supports it. GhostWolf Lab shows how .slk files can carry XLM macros, masquerade…
oxfemale·
May 21·
7 min
·36
// Malware
25 postsAMSI36 GhostTree: The NTFS Trick That Can Make Malware Disappear from EDR Scans
GhostTree abuses NTFS junctions to create recursive, near-endless valid paths. Recursive scanners and EDRs can hang in the maze while malware in…
oxfemale·
May 21·
10 min
·30
Debug27 HWMonitor Trojanized to Deliver Multi-Stage STX RAT via DLL Sideloading
A trojanized HWMonitor archive abuses DLL sideloading with malicious CRYPTBASE.dll to launch multi-stage in-memory loaders and deploy STX RAT.
oxfemale·
May 14·
7 min
·27
Malware46 DLL Sideloading & Proxying for Advance Red Team Engagements
A practical look at DLL sideloading and proxying: how attackers abuse trusted Windows executables to load malicious DLLs while keeping the app…
oxfemale·
May 14·
14 min
·46
DLL Sideloading28 Inside the Trojanized CPU-Z Campaign: DLL Sideloading, Zig Malware, and Multi-Layer Persistence
A trojanized CPU-Z package installs malware through CRYPTBASE.dll sideloading. The Zig-compiled DLL decodes an embedded payload, loads a reflective backdoor, connects to…
oxfemale·
Apr 13·
73 min
·28
EDR727 Tutorial: Adaptix C2 with ShellcodePack and MacroPack
This tutorial shows how to weaponize Adaptix C2 agents using ShellcodePack and MacroPack, converting payloads into shellcode and packaging them in evasive…
oxfemale·
Apr 9·
9 min
·727
Bypassing444 COMouflage: Stealthy DLL Surrogate Injection for Process Tree Evasion
COMouflage is a stealthy Windows injection technique that abuses COM DLL Surrogates to execute malicious DLLs inside dllhost.exe, making svchost.exe appear as…
oxfemale·
Apr 7·
12 min
·444
Cisco25 Blinding the Defenders: Inside Qilin’s EDR-Killer Malware
Cisco Talos analyzes a Qilin ransomware EDR-killer that disables over 300 security drivers. The multi-stage malware uses obfuscation and kernel-level techniques to…
oxfemale·
Apr 3·
22 min
·25
Debug50 Inside the Payload: Manual Shellcode Analysis with Ghidra
The article demonstrates how to analyze Windows shellcode in Ghidra by identifying API-hashing routines, resolving hidden Windows API calls, and extracting C2…
oxfemale·
Mar 31·
13 min
·50
.NET3.8k Can it Resolve DOOM? Game Engine in 2,000 DNS Records
The article shows a proof-of-concept where DOOM is stored across ~2,000 DNS TXT records and executed directly from memory. A PowerShell loader…
oxfemale·
Mar 22·
7 min
·3.8k
BYOUD34 Invisible Execution: Hiding Malware with Unwind Metadata Manipulation
The article introduces BYOUD, a Windows evasion technique that manipulates unwind metadata to spoof call stacks without altering return addresses, allowing malware…
oxfemale·
Mar 20·
37 min
·34
Antivirus32 Reverse engineering undocumented Windows Kernel features to work with the EDR
This article demonstrates how to reverse engineer the Windows 11 kernel to understand undocumented internals behind memory operations and ETW Threat Intelligence…
oxfemale·
Mar 14·
18 min
·32