[b]

[/b]

Advance Keylogger & Stealer
Introduction: Keylogger Malware
Cybereason’s Nocturnus team is tracking a new keylogger gaining traction among cybercriminals called Phoenix. The keylogger first emerged in July 2019 packed with a myriad of information-stealing features. These features extend beyond solely logging keystrokes, to the point where we are inclined to classify it as an infostealer.
This research explains several aspects of the Phoenix keylogger, including:
A Look Into the Underground Community: The underground, ongoing marketing efforts to promote Phoenix and its reception in the underground community.
A Technical Breakdown: A technical breakdown of the Phoenix keylogger, including info stealing capabilities, communication through Telegram, and potential persistence.
The Connection to a Previous Keylogger: The discovery of the Phoenix keylogger’s connection to the “orphaned” Alpha keylogger.
Key Findings
The Phoenix Keylogger: The Cybereason Nocturnus team is investigating multiple incidents of a new, emerging keylogger called Phoenix, and is now able to provide details into the keylogger’s operations and its creator.
Steals Data From Multiple Sources: Phoenix operates under a malware-as-a-service model and steals personal data from almost 20 different browsers, four different mail clients, FTP clients, and chat clients.
Tries to Stop over 80 Security Products: On top of its information stealing features, Phoenix has several defensive and evasive mechanisms to avoid analysis and detection, including an Anti-AV module that tries to kill the processes of over 80 different security products and analysis tools.
Targets Across Continents: Despite Phoenix having been released in July 2019, it has already targeted victims across North America, the United Kingdom, France, Germany and other parts of Europe and the Middle East. We expect more regions to be affected as it gains popularity.
Exfiltrates Data through Telegram: Phoenix offers common SMTP and FTP exfiltration protocols, but also supports data exfiltration over Telegram. Telegram, a popular chat application worldwide, is leveraged by cybercriminals for its legitimacy and end-to-end encryption.
Has the Same Author as the Alpha Keylogger: Phoenix was clearly authored by the same team behind the Alpha keylogger, which disappeared earlier this year.
“Malware for the People”: This research showcases the ever-growing popularity of the Malware-as-a-Service model in the cybercrime ecosystem. Malware authors are developing malware that is easy for any user to operate and comes bundled with customer support

[/center]

DDosPing
DDOS
DDOS
Version 1.2.4
Build Status Gem Version
A bash script inspired by pentbox.
Designed to be a simple way to implement various network pentesting functions, including network attacks, using wherever possible readily available software commonly installed on most linux distributions without having to resort to multiple specialist tools.
Sudo is implemented where necesssary.
Tested on Debian and Arch.
Requirements:
bash
sudo
curl
netcat (must support '-k' option, openbsd variant recommended)
hping3 (or nping can be used as a substitute for flood attacks)
openssl
stunnel
nmap
whois (not essential but preferred)
nslookup (or 'host')
How to use?
Download the script:
$ wget Make it executable:
$ chmod +x ./ddos
Run it:
$ ./ddos
Module detail
RECON MODULES
Show IP - uses curl to perform a lookup of your external IP. Runs ip a or ifconfig (as appropriate) to show local interface IP's.
DNS Recon - passive recon, performs a DNS lookup (forward or reverse as appropriate for target input) and a whois lookup of the target. If whois is not available it will perform a lookup against ipinfo.io (only works for IP's, not hostnames).
Ping Sweep - uses nmap to perform an ICMP echo (ping) against the target host or network.
Quick Scan - TCP Port scanner using nmap to scan for open ports using TCP SYN scan. Nmap will not perform a ping sweep prior to performing the TCP SYN scan. This module scans the 1,000 most common ports. This module can, of course, be used to scan a single host or a full network. This scan can take a long time to finish, please be patient.
Detailed Scan - uses nmap to identify live hosts, open ports, attempts OS identification, grabs banners/identifies running software version and attempts OS detection. Nmap will not perform a ping sweep prior as part of this scan. Nmap's default User-Agent string is changed to that of IE11 in this mode, to help avoid detection via HTTP. All TCP ports on the target (hostname/IP/subnet) are scanned. This scan can take a long time to finish, please be patient.
UDP scan - uses nmap to scan for open UDP ports. All UDP ports are scanned.
Check Server Uptime - estimates the uptime of the target by querying an open TCP port with hping. Accuracy of the results varies from one machine to another; this does not work against all servers.
DOS MODULES
TCP SYN Flood - sends a flood of TCP SYN packets using hping3. If hping3 is not found, it attempts to use the nmap-nping utility instead. Hping3 is preferred since it sends packets as fast as possible. Options are provided to use a source IP of your interface, or specify (spoof) a source IP, or spoof a random source IP for each packet. Optionally, you can add data to the SYN packet. All SYN packets have the fragmentation bit set and use hpings virtual MTU of 16 bytes, guaranteeing fragmentation. Falling back to nmap-nping means sending X number of packets per second until Y number of packets is sent and only allows the use of interface IP or a specified (spoofed) source IP. A TCP SYN flood is unlikely to break a server, but is a good way to test switch/router/firewall infrastructure and state tables. Note that whilst hping will report the outbound interface and IP which might make you think script does not work as expected, the source IP will be set as specified; review a packet capture of the traffic if in doubt! Since the source port is definable, it is simple to launch a LAND attack for example. The ability to set the source port also allows, for example, sending SYN packets to one target and forcing the SYN-ACK responses to a second target.

[/center]

ABCProxy.CoM Brute And Latest Version Checker 2026
is a free HTTP-based account testing tool with SOCKS5/HTTP proxy support, CAPTCHA bypass, and NodeJS ...

[/center]

[/center]

0x0 Crypter - Free open sourced Crypter.
Overview
0x0 Crypter is a open sourced crypter fully coded by @MpCmdRun
? Features
? Base64 Protection - Provides a basic protection to your exe on runtime.
?️ AMSI Bypass - Provides a temporary Bypass to the AmsiScanBuffer on Windows 10 and 11.
?️ ETW Bypass - Provides a temporary ETW Bypass on Windows 10 and 11.
? Run as admin - Provides the applicaiton to be ran as administrator (RunAs UAC Bypass).
? Startup - Creates a scheduled Task to run this .exe everytime to computer turns back on.

[/center]

[center]Dedi Exploiter V2[center]

[center][B][center]

Dedi Exploiter V2 is commonly described as a tool associated with testing vulnerabilities in dedicated servers. It is often linked with identifying weak configurations, outdated software, or exploitable entry points.

? Scanning servers for vulnerabilities

⚡ Identifying outdated services or open ports

?️ Attempting exploitation techniques (in controlled environments)

? Reporting weak points in server infrastructure

[center][B][center]

[center][center]

[center][center]

[center][center]

High Orbit Ion Cannon (HOIC)(DDoS)
HOIC 2.1
HOIC is a network stress testing tool written in programming languages like C# and Visual Basic. It was created as an open-source alternative to replace the original Low Orbit Ion Cannon (LOIC) application that was used to perform volume-based DDoS attacks.
Key features provided by HOIC include:
Generating high volumes of GET and POST web requests
Support for targeting multiple URLs/domains concurrently
Graphical and command-line attack interfaces
Scripting capabilities to customize attack parameters
SOCKS proxy support to obfuscate traffic
TLS 1.2 encryption to bypass restrictions
Automated update capability to evade blacklist blocking
While ostensibly designed for stress testing, in practice, HOIC is predominantly used maliciously to overload and disrupt websites and web applications via DDoS attack.

[/center]