免杀中用到的工具
🟢 绝大部分无法直接生成免杀木马，开发、测试免杀时会用到。
| 工具简称 | 概述 | 工具来源 | 下载路径 |
| x64dbg 中文版安装程序(Jan 6 2024).exe | 52pojie | ||
| hellshell | 官方的加密或混淆shellcode | github | Releases · ORCA / HellShell · GitLab |
| hellshell-网络版本 | github | GitHub - SenSecurity/Hellshell-with-more-fuctionality: HellShell with More functionality | |
| Dependencies.AheadLib.Plugin | 在dependencies上额外加了导出函数 | 看雪 | [原创]我在Dependencies项目上做了个Aheadlib插件-编程技术-看雪-安全社区|安全招聘|kanxue.com |
| Dependencies | github | GitHub - lucasg/Dependencies: A rewrite of the old legacy software "depends.exe" in C# for Windows devs to troubleshoot dll load dependencies issues. | |
| ChangeTimestamp.exe | 更改时间戳 | ||
| sgn_windows_amd64_2.0.1 | 对二进制文件编码免杀shellcode | github | GitHub - EgeBalci/sgn: Shikata ga nai (仕方がない) encoder ported into go with several improvements |
| Resource Hacker | |||
| BeaconEye_x64 | 通过扫描CobaltStrike中的内存特征，并进行Beacon Config扫描解析出对应的Beacon信息 | github | Releases · CCob/BeaconEye · GitHub |
| Hunt-Sleeping-Beacons | github | GitHub - thefLink/Hunt-Sleeping-Beacons: Aims to identify sleeping beacons | |
| yara-master-2298-win64 | 分类恶意软件样本的工具 | github | GitHub - VirusTotal/yara: The pattern matching swiss knife |
| Windows_Trojan_CobaltStrike.yar | Elastic安全公司开源检测CobaltStrike的yara规则 | github | protections-artifacts/yara/rules/Windows_Trojan_CobaltStrike.yar at main · elastic/protections-artifacts · GitHub |
| hollows_hunter64 | github | GitHub - hasherezade/hollows_hunter: Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches). | |
| arsenal_kit | telegram | ||
| DLLSpy | 检测正在运行的进程、服务及其二进制文件中的 DLL 劫持 | github | |
| Process Hacker 2 | 查看进程 | ||
| Alcatraz | 没下载， x64 二进制混淆器，能够混淆各种不同的 pe 文件 | github | GitHub - weak1337/Alcatraz: x64 binary obfuscator |
| pestudio-9.58 | 查看文件熵值等信息，逆向等可用 | 官网下载 | Winitor |
| https://junkcode.gehaxelt.in/ | 垃圾代码生成器，降低熵值 | github | GitHub - gehaxelt/PHP-C---JunkCodeGenerator: A junkcode generator for C++ classes written in PHP |
| sgn_windows_amd64_2.0.1 | 编码shellcode | github | |
| ChangeTimestamp.exe | 改时间 | ||
| SigThief | 把签名撕取下来 | github | GitHub - secretsquirrel/SigThief: Stealing Signatures and Making One Invalid Signature at a Time |
| Restorator2018 | 伪造图标 | https://www.sqlsec.com/tools.html | https://www.sqlsec.com/tools.html |
| BeCyIconGrabber.exe | 伪造图标 | https://www.sqlsec.com/tools.html | https://www.sqlsec.com/tools.html |
| SourcePoint | 自生成Malleable C2 profile | github | GitHub - Tylous/SourcePoint: SourcePoint is a C2 profile generator for Cobalt Strike command and control servers designed to ensure evasion. |
| S-inject | DLL+Shellcode的Windows注入免杀工具 | github | GitHub - Joe1sn/S-inject: 支持x86/x64的DLL和Shellcode 的Windows注入的免杀工具，支持图形化界面 |
| RingQ | 免杀，exe2shellcode | github | GitHub - T4y1oR/RingQ: 一款后渗透免杀工具，助力每一位像我这样的脚本小子快速实现免杀，支持bypass AV/EDR 360 火绒 Windows Defender Shellcode Loader |
| pe2shc.exe | pe_to_shellcode | github | GitHub - hasherezade/pe_to_shellcode: Converts PE into a shellcode |