WithSecure Labs

Popular repositories Loading

1. doublepulsar-detection-script doublepulsar-detection-script Public

   A python2 script for sweeping a network to find windows systems compromised with the DOUBLEPULSAR implant.

   Python 1k 308

2. python-exe-unpacker python-exe-unpacker Public

   A helper script for unpacking and decompiling EXEs compiled from python code.

   Python 1k 351

3. CallStackSpoofer CallStackSpoofer Public

   A PoC implementation for spoofing arbitrary call stacks when making sys calls (e.g. grabbing a handle via NtOpenProcess)

   C++ 599 73

4. LinuxCatScale LinuxCatScale Public

   Incident Response collection and processing scripts with automated reporting scripts

   Shell 340 60

5. doublepulsar-c2-traffic-decryptor doublepulsar-c2-traffic-decryptor Public

   A python2 script for processing a PCAP file to decrypt C2 traffic sent to DOUBLEPULSAR implant

   Python 225 77

6. snake snake Public

   snake - a malware storage zoo

   Shell 217 38