MalDev

The Indoctrination | Malcore Malware Bible

Windows API

MalAPI.io

NTAPI Undocumented Functions

Programming reference for the Win32 API - Win32 appsdocsmsft

Windows API index - Win32 appsdocsmsft

GitHub - 7etsuo/windows-api-function-cheatsheets: A reference of Windows API function calls, including functions for file operations, process management, memory management, thread management, dynamic-link library (DLL) management, synchronization, interprocess communication, Unicode string manipulation, error handling, Winsock networking operations, and registry operations.GitHub

Syscalls

Trampolines

Avoiding direct syscall instructions by using trampolines

GitHub - eversinc33/BouncyGate: Indirect Syscalls: HellsGate in Nim, but making sure that all syscalls go through NTDLL.DLL (as in RecycledGate).GitHub

GitHub - Maldev-Academy/HellHall: Performing Indirect Clean SyscallsGitHub

Web-based Payload Staging

GitHub - ytincodenito/PayloadStagingGitHub

DLL Hijacking / DLL Sideloading

DLL Hijacking

r-tec Blog | DLL Sideloadinglsecqt

DLL Proxying

DLL Hijacking - A New Spin on Proxying your Shellcode - Black Hills Information SecurityBlack Hills Information Security

GitHub - Tylous/FaceDancer: FaceDancer is an exploitation tool aimed at creating hijackable, proxy-based DLLs by taking advantage of COM-based system DLL image loadingGitHub

Reduce entropy and obfuscate

GitHub - Maldev-Academy/EntropyReducer: Reduce Entropy And Obfuscate Youre Payload With Serialized Linked ListsGitHub

Workshop

GitHub - chvancooten/maldev-for-dummies: A workshop about Malware DevelopmentGitHub

GitHub - chr0n1k/AH2021Workshop: Malware development for red teaming workshopGitHub

GitHub - cr-0w/maldev: ⚠️ malware developmentGitHub

GitHub - Whitecat18/Rust-for-Malware-Development: This repository contains my complete resources and coding practices for malware development using Rust 🦀.GitHub

Resources

Getting Started With Malware DevelopmentCrow's Nest

Awesome-Cybersecurity-Handbooks/handbooks/malware_development.md at main · 0xsyr0/Awesome-Cybersecurity-HandbooksGitHub

Videos

crowYouTube

LsecqtYouTube