# Malware Development

## Malware Development

- [Golang Malware Development](https://www.scriptchildie.com/golang-malware-development.md)
- [Golang Programming Intro](https://www.scriptchildie.com/malware-development-in-golang-introduction/golang-programming-intro.md)
- [1. Preparing the Go Environment](https://www.scriptchildie.com/malware-development-in-golang-introduction/golang-programming-intro/1.-preparing-the-go-environment.md): #golang
- [2. Hello World](https://www.scriptchildie.com/malware-development-in-golang-introduction/golang-programming-intro/2.-hello-world.md): #golang #helloworld
- [3. Calling MessageBox winAPI from GO](https://www.scriptchildie.com/malware-development-in-golang-introduction/golang-programming-intro/3.-calling-messagebox-winapi-from-go.md): #systemprogramming #golang #messagebox
- [4. Shellcode Runner](https://www.scriptchildie.com/malware-development-in-golang-introduction/golang-programming-intro/4.-shellcode-runner.md): #shellcoderunner #golang #maldev #malwaredevelopment
- [Shellcode Injection](https://www.scriptchildie.com/code-injection-techniques/shellcode-injection.md)
- [1. Classic Shellcode Injection](https://www.scriptchildie.com/code-injection-techniques/shellcode-injection/1.-classic-shellcode-injection.md): #shellcodeinjection #golang #maldev #malwaredevelopment
- [2. Process Hollowing](https://www.scriptchildie.com/code-injection-techniques/shellcode-injection/2.-process-hollowing.md): #processhollowing#golang #maldev #malwaredevelopment
- [3. QueueUserAPC](https://www.scriptchildie.com/code-injection-techniques/shellcode-injection/3.-queueuserapc.md): #processinjection #queueUserAPC #golang #maldev #malwaredevelopment
- [DLL Injection](https://www.scriptchildie.com/code-injection-techniques/dll-injection.md)
- [1. Dll Injection](https://www.scriptchildie.com/code-injection-techniques/dll-injection/1.-dll-injection.md): #processinjection #dllinjection #golang #maldev #malwaredevelopment
- [2. Reflective DLL Injection](https://www.scriptchildie.com/code-injection-techniques/dll-injection/2.-reflective-dll-injection.md): #malware #development #golang #dllinjection #reflective #redteam
- [Payloads](https://www.scriptchildie.com/payloads/payloads.md)
- [1. Basic DLL using Golang](https://www.scriptchildie.com/payloads/payloads/1.-basic-dll-using-golang.md): #golang #maldev #malwaredevelopment #persistence
- [2. Malicious DLL using Golang](https://www.scriptchildie.com/payloads/payloads/2.-malicious-dll-using-golang.md): #golang #maldev #malwaredevelopment #persistence #shellcoderunner
- [3. Malicious XLL using Golang](https://www.scriptchildie.com/payloads/payloads/3.-malicious-xll-using-golang.md): #golang #maldev #malwaredevelopment #persistence #shellcoderunner #excelplugin #xll
- [Shellcode development](https://www.scriptchildie.com/payloads/shellcode-development.md): #golang #shellcode #x64 #windows #srdi
- [1. Keystone Engine](https://www.scriptchildie.com/payloads/shellcode-development/1.-keystone-engine.md): #keystone-engine #assembler #golang-bindings
- [2.  Windows x64 Shellcode Development intro](https://www.scriptchildie.com/payloads/shellcode-development/2.-windows-x64-shellcode-development-intro.md): #x64 #shellcode #golang #asm
- [3. Transforming DLLs into Shellcode](https://www.scriptchildie.com/payloads/shellcode-development/3.-transforming-dlls-into-shellcode.md): #srdi #golang #assembly #x64 #shellcode #shellcodedevelopment
- [AV Bypass](https://www.scriptchildie.com/evasion/av-bypass.md)
- [1. Introduction](https://www.scriptchildie.com/evasion/av-bypass/1.-introduction.md): #AVEvasion #Golang #maldev #malwaredevelopment
- [2. Remove the shellcode from the payload](https://www.scriptchildie.com/evasion/av-bypass/2.-remove-the-shellcode-from-the-payload.md): #AVEvasion #Golang #maldev #malwaredevelopment
- [3. Delay Execution](https://www.scriptchildie.com/evasion/av-bypass/3.-delay-execution.md)
- [1. time.Sleep() 1/2](https://www.scriptchildie.com/evasion/av-bypass/3.-delay-execution/1.-time.sleep-1-2.md): #AVEvasion #Golang #maldev #malwaredevelopment #sleep
- [2. time.Sleep() 2/2](https://www.scriptchildie.com/evasion/av-bypass/3.-delay-execution/2.-time.sleep-2-2.md): #AVEvasion #Golang #maldev #malwaredevelopment #sleep
- [3. Custom Sleep function](https://www.scriptchildie.com/evasion/av-bypass/3.-delay-execution/3.-custom-sleep-function.md): #AVEvasion #Golang #maldev #malwaredevelopment #sleep
- [4. XOR Encryption](https://www.scriptchildie.com/evasion/av-bypass/4.-xor-encryption.md): #AVEvasion #Golang #maldev #malwaredevelopment
- [5. AMSI Bypass](https://www.scriptchildie.com/evasion/av-bypass/5.-amsi-bypass.md): #amsi #amsibypass #golang #maldev #malwaredevelopment
- [EDR Bypass](https://www.scriptchildie.com/evasion/edr-bypass.md): #EDREvasion #Golang #maldev #malwaredevelopment
- [1. Setting up a testing environment](https://www.scriptchildie.com/evasion/edr-bypass/1.-setting-up-a-testing-environment.md): #OpenEDR #xcitium #elastic
- [2. Userland Hooks](https://www.scriptchildie.com/evasion/edr-bypass/2.-userland-hooks.md)
- [1. What are userland hooks?](https://www.scriptchildie.com/evasion/edr-bypass/2.-userland-hooks/1.-what-are-userland-hooks.md): #EDREvasion #UserlandHooks
- [2. Load a fresh copy of the dll from disk](https://www.scriptchildie.com/evasion/edr-bypass/2.-userland-hooks/2.-load-a-fresh-copy-of-the-dll-from-disk.md): #EDREvasion #UserlandHooks #unhook
- [3. Programmatically detect ntdll hooks](https://www.scriptchildie.com/evasion/edr-bypass/2.-userland-hooks/3.-programmatically-detect-ntdll-hooks.md): #EDREvasion #UserlandHooks #unhook
- [4. Direct and Indirect Syscalls (shellcode runner)](https://www.scriptchildie.com/evasion/edr-bypass/2.-userland-hooks/4.-direct-and-indirect-syscalls-shellcode-runner.md): #syscalls #directsyscalls #indirectsyscalls #Golang #EDREvasion
- [3. VPN abuse for Endpoint Protection Evasion](https://www.scriptchildie.com/evasion/edr-bypass/3.-vpn-abuse-for-endpoint-protection-evasion.md)
- [1. Global Protect Abuse 1/2](https://www.scriptchildie.com/evasion/edr-bypass/3.-vpn-abuse-for-endpoint-protection-evasion/1.-global-protect-abuse-1-2.md): #globalprotect #redteaming #globalprotect #VPNabuse
- [2. Global Protect Abuse 2/2](https://www.scriptchildie.com/evasion/edr-bypass/3.-vpn-abuse-for-endpoint-protection-evasion/2.-global-protect-abuse-2-2.md): #globalprotect #redteaming #globalprotect #VPNabuse