__ __ ____  ___    __ _______ _   __
   / //_// __ \/   |  / //_/__  // | / /
  / ,<  / /_/ / /| | / ,<   /_ </  |/ / 
 / /| |/ _, _/ ___ |/ /| |___/ / /|  /  
/_/ |_/_/ |_/_/  |_/_/ |_/____/_/ |_/   

Maor Sabag - Red Team Operator & Malware Developer

 

---

Red Team Operator focused on Windows internals, evasion research, and offensive tool development. Building C2 implants, EDR bypasses, and lateral movement tools.

---

Defense Evasion

• TrueSightKiller - AV/EDR killer leveraging vulnerable kernel drivers
• SideLoadingDLL - DLL sideloading for stealthy payload execution
• Paruns-Fart - NTDLL unhooking to bypass EDR userland hooks

C2 & Implant Development

• Adaptix-StealthPalace - Crystal Palace RDLL for Adaptix C2 - Ekko sleep mask, PICO IAT hooks, per-section permission restore
• adaptix-telegram-bot - Telegram interface for Adaptix C2 teamserver management

Red Team Tooling

• impacket-jump - Lateral movement via remote service staging, built on Impacket
• interactive-execute-shellcode - Remote shellcode injection with named pipe output capture
• SafeCrypt - Academic ransomware simulation - AES-256 + asymmetric key exchange

---

Latest post: Sleeping Beauty: Putting Adaptix to Bed with Crystal Palace - Crystal Palace RDLL with Ekko sleep obfuscation, IAT hooking via PICO, and per-section permission restoration for Adaptix C2.