Repository Index

Limon is a sandbox developed as a research project written in python, which automatically collects, analyzes, and reports on the run time indicators of Linux malware. It allows one to inspect Linux malware before execution, during execution, and after execution (post-mortem analysis) by performing static, dynamic and memory analysis using open source tools

A framework for automated extraction of static and dynamic features from Android applications

• android-malware-detection
• android-analysis

A Tool for Automatic Analysis of Malware Behavior

• machine-learning
• clustering
• classification
• malware-analysis

DC3 Malware Configuration Parser (DC3-MWCP) is a framework for parsing configuration information from malware. The information extracted from malware includes items such as addresses, passwords, filenames, and mutex names.

• python
• malware-analysis
• automation
• config-dump

Android Malware Sandbox

File Scanning Framework

• security-tools
• network-defense
• file-analysis
• file-analyzer

C++ application that uses memory and code hooks to detect packers

Modified edition of cuckoo

VolatilityBot – An automated memory analyzer for malware samples and memory dumps

The Multiplatform Linux Sandbox

Incident Response - Fast suspicious file finder

• dfir
• investigation
• incident-response
• threat-hunting

A pintool in order to unpack malware

Automatic deployment of Cuckoo Sandbox malware lab using Packer and Vagrant

Django application that performs SAST and Malware Analysis for Android APKs

• android-security
• sast
• malware-analysis
• code-security

ShowStopper is a tool for helping malware researchers explore and test anti-debug techniques or verify debugger plugins or other solutions that clash with standard anti-debug methods.

• research
• anti-debug
• malware

Android Loadable Kernel Modules - mostly used for reversing and debugging on controlled systems/emulators

• loadable-kernel-modules
• android-lkms
• emulators
• kernel

Android Mobile Device Hardening

• forensic
• security
• hardening
• android-security

Wraps around various tools and provides some additional checks/information to produce a centralized report of a PE file.

Tool to help analyze PDF files

A malware/botnet analysis framework written in Ruby.

Malware Analysis Tool using Function Level Fuzzy Hashing

simple YARA-based IOC scanner

• yara
• ioc
• security
• incident-response

Open-source cross-platform defensive spyware, stalkerware and surveillance software detector

• anti-surveillance
• dfir
• keylogger-detector
• privacy

Automatically exported from code.google.com/p/jsunpack-n