• Hides processes, files, network connections, etc.
• Out of the box, single file installer
• Fileless persistence, in-memory injection

• In-memory decryption & execution
• Two-layer execution architecture

• Execution without any files
• Process injection
• Persistence

... It's technically not even there

PinnedLoading

1. r77-rootkitr77-rootkitPublic

   Fileless ring 3 rootkit with installer and persistence that hides processes, files, network connections, etc.

   C 1.8k 418

2. pe-unionpe-unionPublic

   Crypter, binder & downloader with native & .NET stub, evasive by design, user friendly UI

   Assembly 676 149

3. living-off-the-landliving-off-the-landPublic

   Fileless attack with persistence

   C++ 348 57

4. slui-file-handler-hijack-privilege-escalationslui-file-handler-hijack-privilege-escalationPublic

   Slui File Handler Hijack UAC Bypass Local Privilege Escalation

   C++ 92 35

5. self-morphing-csharp-binaryself-morphing-csharp-binaryPublic

   Executable that mutates its own code

   C# 375 107

6. bytecode-apibytecode-apiPublic

   Framework for C# development

   C# 72 23