Maldev-Academy/Christmas

Utilizing TLS callbacks to execute a payload without spawning any threads in a remote process

Abusing Windows fork API and OneDrive.exe process to inject the malicious shellcode without allocating new RWX memory region.

P³-Shellcode Loader is a loader that implements a code injection technique which leverages the Process Parameters structure as an execution and staging location for shellcode injection into remote processes, without triggering common detection mechanisms.

Encrypted shellcode Injection to avoid Kernel triggered memory scans

Malware attacks/techniques explained

A memory-based evasion technique which makes shellcode invisible from process start to end.

RunPE implementation with multiple evasive techniques (1)

Moonwalk++: Simple POC Combining StackMoonwalking and Memory Encryption

Generates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from memory and runs them with parameters