Repository Index

PEframe is a open source tool to perform static analysis on Portable Executable malware and malicious MS Office documents.

Modular file scanning/analysis framework

• python
• analytic-machines
• analysis-framework
• python-script

CuckooDroid - Automated Android Malware Analysis with Cuckoo Sandbox.

Linker/Compiler/Tool detector for Windows, Linux and MacOS.

• detect
• reverse-engineering
• signature
• malware-analysis

Defanged Indicator of Compromise (IOC) Extractor.

• ioc
• indicators-of-compromise
• library
• ioc-extractor

Malware exploits

Java library to analyse Portable Executable files with a special focus on malware analysis and PE malformation robustness

Catch risky npm dependency changes before they merge.

• dependency-analysis
• devsecops
• github-actions
• malware

Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.

• blue-team
• detection-engineering
• edr
• endpoint-detection

Volatility plugin for extracts configuration data of known malware

• malware
• volatility
• forensics
• python

AVClass malware labeling tool

A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.

• cybersecurity
• incident-response
• sysinternals
• nirsoft

Sandbox for semi-automatic Javascript malware analysis, deobfuscation and payload extraction. Written for Node.js

• malware-samples
• wscript
• deobfuscation
• angler

Firewall and Privatizing Proxy for Trackers, Attackers, Malware, Adware, and Spammers with Anti-Virus On-Demand and On-Access Scanning (PF, squid, privoxy, hphosts, dshield, emergingthreats, hostsfile, PAC file, clamav)

• proxy
• tracker
• firewall
• privacy-enhancing-technologies

Drltrace is a library calls tracer for Windows and Linux applications.

• dbi
• malware-analysis
• malware-detection
• api-trace

Limon is a sandbox developed as a research project written in python, which automatically collects, analyzes, and reports on the run time indicators of Linux malware. It allows one to inspect Linux malware before execution, during execution, and after execution (post-mortem analysis) by performing static, dynamic and memory analysis using open source tools

A framework for automated extraction of static and dynamic features from Android applications

• android-malware-detection
• android-analysis

A Tool for Automatic Analysis of Malware Behavior

• machine-learning
• clustering
• classification
• malware-analysis

A Python RESTful API framework for online malware analysis and threat intelligence services.

• python
• cybersecurity
• malware
• malware-analysis

Astral-PE is a low-level mutator (Headers/EP obfuscator) for native Windows PE files (x32/x64)

• cybersecurity
• hacktoberfest
• low-level
• mutator

DC3 Malware Configuration Parser (DC3-MWCP) is a framework for parsing configuration information from malware. The information extracted from malware includes items such as addresses, passwords, filenames, and mutex names.

• python
• malware-analysis
• automation
• config-dump

Python telnet honeypot for catching botnet binaries

• honeypot
• telnet-server
• malware
• botnet

Android Malware Sandbox

🚀AutoRuns is a PowerShell module that will help do live incident response and enumerate autoruns artifacts that may be used by legitimate programs as well as malware to achieve persistence.