mirror of
https://github.com/Cracked5pider/Ekko/
synced 2026-06-06 15:34:27 +00:00
4139c94f468b153d75743da022b1a44e3d3bc833
Ekko
A small sleep obfuscation technique that uses CreateTimerQueueTimer Win32 API.
Proof of Concept. Can be done better
Credit
- Austin Hudson (@SecIdiot) https://suspicious.actor/2022/05/05/mdsec-nighthawk-study.html
- Originally discovered by Peter Winter-Smith and used in MDSec’s Nighthawk
Languages
C
90.8%
Makefile
9.2%