KiExitDispatcher

GoDefender. Anti Virtulization, Anti Debugging, AntiVM, Anti Virtual Machine, Anti Debug, Anti Sandboxie, Anti Sandbox, VM Detect package. Windows ONLY.

GoRedOps. 🦫 | GoRedOps is a repository dedicated to gathering and sharing advanced techniques and offensive malware for Red Team, with a specific focus on the Go programming language, all is made for educational purpoeses only.

EDR-XDR-AV-Killer. Reproducing Spyboy technique, which involves terminating all EDR/XDR/AVs processes by abusing the zam64.sys driver

ThunderKitty. 🔑 Open source stealer written in Go, all logs will be sent to Telegram bot.

Ebyte-Go-Morpher. Ebyte-Go-Morpher is a Go program that parses, analyzes, and rewrites Go source code to apply multiple layers of obfuscation. It operates directly on the Go Abstract Syntax Tree (AST) and generates both obfuscated source files and runtime decryption logic.

Lifetime-Amsi-EtwPatch. Two in one, patch lifetime powershell console, no more etw and amsi!

Shellcode-Loader. This is way to load a shellcode, and obfuscate it, so it avoids scantime detection.

PyDefender. Anti Virtulization, Anti Debugging, AntiVM, Anti Virtual Machine, Anti Debug, Anti Sandboxie, Anti Sandbox, VM Detect package.

Ebyte-AMSI-ProxyInjector. A lightweight tool that injects a custom assembly proxy into a target process to silently bypass AMSI scanning by redirecting AmsiScanBuffer calls. It suspends the target’s threads, patches the function to always return AMSI_RESULT_CLEAN without altering original bytes directly, ensuring stealthy AMSI bypass.

PayloadCrypter. Go Based Crypter That Can Bypass Any Kinds Of Antivirus Products, payload crypter supports over 4 programming languages.

EvilByte-Remote-AMSI-Bypass. Bypasses AMSI protection through remote memory patching and parsing technique.

Nyx-Full-Dll-Unhook. (EDR) Dll Unhooking = kernel32.dll, kernelbase.dll, ntdll.dll, user32.dll, apphelp.dll, msvcrt.dll.

EByte-Ransomware. Go ransomware leveraging ChaCha20 and ECIES encryption with a web-based control panel.

Ebyte-ETW-Redirector. A lightweight tool that injects a custom assembly proxy into a target process to silently bypass ETW scanning by redirecting ETW calls to custom proxy.

EByte-VBS-Obfuscator-Go. VBS-Obfuscator-GO is a Go-based tool designed for obfuscating VBScript (VBS) files. It transforms readable VBScript code into a less recognizable form by employing random variable names and encoding character values using mathematical operations. This helps protect scripts from casual inspection and modification.

Lifetime-AmsiBypass. Lifetime AMSI bypass.

Ntdll-Unhook. Unhook Ntdll.dll, Go & C++.

EDR-XDR-AV-Bypass-Shellcode-Loader. Bypassing Major EDR's with staged shellcode, custom getmodulehandleW and getprocaddress, veh syscalls & more.

TaskMgr-Troll. Troll TaskManager, and play with it .

Keylogger. Go keylogger for Windows, logging keyboard input to a file using Windows API functions, and it is released under the Unlicense.

ThunderKitty-Ransomware. Ransomware written in go, encrypt - decrypt.

EByte-Pattern-AmsiPatch. Pattern-based AMSI bypass that patches AMSI.dll in memory by modifying comparison values, conditional jumps, and function prologues to neutralize malware scanning without modifying any files on disk.

Amsi-Patch-Updated-2025. How to bypass AMSI (Antimalware Scan Interface) in PowerShell/C++ by dynamically patching the AmsiScanBuffer function.

Evilbytecode-Gate. Evilbytecode-Gate resolves Windows System Service Numbers (SSNs) using two methods: analyzing the Guard CF Table in ntdll.dll and parsing ntoskrnl.exe for Zw-prefixed system calls.

Evilbytecode-Shellcode-Go-Tactics. A mutliple tactics to execute shellcode in go :}

Go-Assembly. Examples how to use a Assm (Assembly) in a go.

PPID-Spoofing. Parent Process ID Spoofing, coded in CGo.

Evilbytecode-Anti-VM. Measures average CPU cycles for the CPUID instruction to detect if the code is running in a VM by comparing against a threshold.

PhantomDelay. PhantomDelay is a precise delay function that uses the Windows high resolution performance counter to pause your program for a specified number of seconds.

Evil-Go. A malicous Golang Package

IATPhantom. IATPhantom dynamically loads and resolves functions from DLLs while hiding from the Import Address Table (IAT), making it invisible to common detection techniques.

SsnRetrieval. Loads NTDLL, parses the PE file, extracts "Zw" functions, retrieves their System Service Numbers (SSNs), and prints each function’s name, SSN, and address.

GoEvilDocs. Malware development in Go, learn today, anti dynamic analysis & Static & sandboxes.

CMD-Arg-Spoof. Manipulate PEB, and patch CmdArgs - RTL_USER_PROCESS_PARAMETERS..

Staged-Shellcode-Loader. Beacuse it was leaked, enjoy use with donut.

GolangStyle. GolangStyle, best looking go library.

Malwarebytes-Shutdowner. Kill malawarebytes process. Can be ported to any programming language.

Self-Run-PE. Self PE Injector in C++, using NtApi.

ETW-Patch. code snippet provided demonstrates how to patch the EtwEventWrite function in the ntdll.dll library on Windows using CGO (C Go).

Eset-Unload. Eset-Unload is a C++ tool that interacts with a process's loaded modules to identify and unload the ebehmoni.dll module, typically found in ESET security software. It attempts to safely unload or manually load and unload the module.

Powershell-Persistance. Whenever PowerShell is launched, Notepad will also open. You can customize the script for educational purposes, but I emphasize that I do not take any responsibility for its use or any actions taken.

PS2BAT. A Documentation for my module PS2BAT, it converts Powershell Scripts to Batchfile ones.

RubyRedOps. 💎 | RubyRedOps is a repository for advanced Red Team techniques and offensive malware, focused on Ruby

VK-Api-Amsi-Bypass. The Vulkan loader vulkan-1.dll has internal trampoline functions that perform checksum validation before executing callbacks., lets use that for our usage.

Discord-Webhook-Protector. A PHP-based API protection system that secures webhooks from abuse and attacks. It features rate limiting, IP blacklisting, VPN/proxy detection, and detailed audit logging, ensuring safe and efficient API usage.

GetSyscallStubGo. GetSyscallStubCGo.

Enable-All-Tokens. Enable-All-Tokens is a Go-based project designed to adjust and enable a list of specified privileges for the current process token on a Windows operating system. This project can be particularly useful for developers and system administrators who need to programmatically enable various system privileges for their applications.

Bloxstrap-Persistance. Bloxstrap-Persistance modifies Bloxstrap's settings (Settings.json) to add persistent integrations, showcasing how applications can be exploited.

Keyauth-Protected-App-Go. Keyauth-Protected-App-Go is a Go-based application that integrates with the KeyAuth API to provide secure user authentication. It comes with built-in anti-debugging and anti-DLL injection features to protect against reverse engineering and unauthorized modifications.

Evilbytecode.

CMD-Persistence. PoC, everytime you launch cmd, notepad does aswell (EXAMPLE PROCESS)

D-ntdll-unhook. a simple code to unhook ntdll lol.

veh-syscalls-shellcode. NFS

Cpp-Red-Ops. C++ Red Opsec, im making this beacuse i want to learn more.

RoSint. Roblox osint, gets some info about user.

CustomGetProcAdress. Workaround X86-X64 Golang example.

EByte-Personal-Tools. Some personal tools i use sometiems when developing an go based grabber.