Repository Index

Script to create templates to use with VirtualBox to make vm detection harder

• virtualbox
• antivm
• sandbox
• malware-analysis

Collection of almost 40.000 javascript malware samples

• malware-samples
• malware-research
• javascript
• malware-jail

A machine learning tool that ranks strings based on their relevance for malware analysis.

• machine-learning
• fireeye-flare
• strings
• malware-analysis

Framework for Making Environmental Keyed Payloads (NO LONGER SUPPORTED)

• powershell
• golang
• python
• clueless-agents

HaboMalHunter is a sub-project of Habo Malware Analysis System (https://habo.qq.com), which can be used for automated malware analysis and security assessment on the Linux system.

• malware-analysis
• dynamic-analysis
• security
• linux

Fast and dependency-free cryptographic hashing library for node.js and browsers (supports MD5, SHA1, SHA256, SHA512, RIPEMD, HMAC)

• hashing-algorithm
• javascript
• hmac
• hexadecimal

Malicious HTTP traffic explorer

ClamAV antivirus scanning for Node.js — scan file uploads with a single function call. Zero dependencies. Typed Symbol verdicts. Local or Docker/clamd.

• clamscan
• file-scanner
• virus-scan
• docker-compose

A tool for studying JavaScript malware.

• malware
• malwareanalysis
• nodejs
• es6

A revamped and updated version of my original OneRuleToRuleThemAll hashcat rule

Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.

• beacons
• blue-team
• c2
• command-and-control

A "malicious" DNS server for executing DNS Rebinding attacks on the fly (public instance running on rebind.network:53)

• dns
• dns-rebinding
• hacking
• malicious-domains

WinDBG Anti-RootKit Extension

• kernel-mode
• c-plus-plus
• malware
• malware-analysis

PEframe is a open source tool to perform static analysis on Portable Executable malware and malicious MS Office documents.

Modular file scanning/analysis framework

• python
• analytic-machines
• analysis-framework
• python-script

Witness is a pluggable framework for software supply chain risk management. It automates, normalizes, and verifies software artifact provenance.

• security-tools
• security
• attestation
• verification

CuckooDroid - Automated Android Malware Analysis with Cuckoo Sandbox.

Incident Response Forensic Framework

Linker/Compiler/Tool detector for Windows, Linux and MacOS.

• detect
• reverse-engineering
• signature
• malware-analysis

Defanged Indicator of Compromise (IOC) Extractor.

• ioc
• indicators-of-compromise
• library
• ioc-extractor

Malware exploits

Java library to analyse Portable Executable files with a special focus on malware analysis and PE malformation robustness

Yet another static code analyzer for malicious Android applications

Catch risky npm dependency changes before they merge.

• dependency-analysis
• devsecops
• github-actions
• malware