Amber
A reflective PE packer for in-memory execution of Windows executables to bypass security products.
What is Amber?
Amber is a reflective PE packer that loads and executes Windows Portable Executable files (EXE, DLL, SYS) directly in memory. It solves the problem of deploying payloads stealthily by avoiding disk writes and bypassing security products like anti-virus and intrusion detection systems.
Security researchers, penetration testers, and red team operators who need to deploy evasive payloads during assessments or simulations.
Developers choose Amber for its focus on evasion, offering features like in-memory execution, payload encoding, and memory cleanup that make it effective against modern security defenses.
Overview
Reflective PE packer.
Use Cases
Best For
- Bypassing anti-virus and EDR solutions with fileless payloads
- Deploying reflective DLLs for post-exploitation in red team exercises
Related Projects
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
