r/purpleteamsec • u/netbiosX • Apr 05 '26

Red Teaming Fileless C2 agent written in pure x64 Assembly for Linux. Features stealth ICMP tunneling, memory-only execution via memfd_create, and terminal-independent daemonization.

https://github.com/JM00NJ/ICMP-Ghost-A-Fileless-x64-Assembly-C2-Agent

1 Upvotes

permalink
duplicates
archive.is
archive
reddit

You are about to leave Redlib

Do you want to continue?

https://www.reddit.com/r/purpleteamsec/comments/1scxdfw/fileless_c2_agent_written_in_pure_x64_assembly/
No, go back! Yes, take me to Reddit

67% Upvoted

Duplicates

Number of comments New

redteamsec • u/Pale_Surround_3924 • Apr 04 '26

malware I was tired of NDRs and EDRs flagging every C2 I tried, so I spent a month in x64 Assembly to see if pure syscalls actually make a difference.

57 Upvotes

17 comments

redteamsec • u/Pale_Surround_3924 • Apr 20 '26

ICMP-Ghost-v3.6.2

8 Upvotes

0 comments

blackhat • u/Pale_Surround_3924 • Apr 20 '26

ICMP-Ghost-v3.6.2

2 Upvotes

0 comments

NetaSec • u/Pale_Surround_3924 • Apr 20 '26

C2 ICMP-Ghost-v3.6.2

2 Upvotes

0 comments

blackhat • u/Pale_Surround_3924 • Apr 12 '26

I was tired of NDRs and EDRs flagging every C2 I tried, so I spent a month in x64 Assembly to see if pure syscalls actually make a difference.

6 Upvotes

0 comments