NtDallas

KrakenMask. Sleep obfuscation

MemLoader. Run native PE or .NET executables entirely in-memory. Build the loader as an .exe or .dll—DllMain is Cobalt Strike UDRL-compatible

Draugr. BOF with Synthetic Stackframe

BOF_RunPe. BOF to run PE in Cobalt Strike Beacon without console creation

BOF_ExecuteAssembly. Beacon Object File for Cobalt Strike that executes .NET assemblies in beacon with evasion techniques.

OdinLdr. Cobaltstrike Reflective Loader with Synthetic Stackframe

Svartalfheim. Stage 0

BOF_Spawn. Cobalt Strike BOF for beacon/shellcode injection using fork & run technique with Draugr synthetic stack frames

Ulfberht. Shellcode loader

Huginn. C++