Repository Index

A modular Python application to pull intelligence about malicious files

• malware-analysis
• malware-research
• investigation
• cybersecurity

Automated malware unpacker

Detect and log CVE-2019-19781 scan and exploitation attempts.

Simple framework to extract "actionable" data from Android malware (C&Cs, phone numbers etc.)

Malware/IOC ingestion and processing engine

A honeypot for malware that propagates via USB storage devices

Ragpicker is a Plugin based malware crawler with pre-analysis and reporting functionalities. Use this tool if you are testing antivirus products, collecting malware for another analyzer/zoo.

Tool to help guess a files 256 byte XOR key by using frequency analysis

• frequency-analysis
• python
• xor
• malware

Awesome Splunk SPL hunt queries that can be used to detect the latest vulnerability exploitation attempts & subsequent compromise

• detection
• splunk
• bpfdoor
• vulnerability

Docker image gathering packers and tools for making datasets of packed executables and training machine learning models for packing detection

• docker-image
• executable-packing
• malware-packers
• research-platform

Sublime Malware Research Tool

An ICAP Server with yara scanner for URL and content.

• python
• icap-server
• yara
• malware-analysis

HoneyHTTPD is a Python-based web server honeypot/service imitation builder. Great for honeypots or faking HTTP services.

• python
• honeypot
• honeypot-http
• python-web

Builds json representation of PDF malware sample

Zero-overhead eBPF process tracer for Linux malware triage and incident response. Traces syscalls, network, and file events per-process without strace overhead.

• bpf
• ebpf
• forensics
• golang

Analysis tool for estimating the likelihood that a binary contains compressed or encrypted bytes

• entropy
• pe-file
• pe-files
• pe-format

Cryptographic Dataset Generation & Modelling Framework

• cryptography
• deep-learning
• deep-neural-networks
• machine-learning

Android Malware Behavior Deleter

• android
• malware
• antivirus
• editor

Self-hosted AI-assisted CTI-to-detection workbench for ATT&CK mapping, IOC/CVE intelligence, Threat Radar, malware triage, Attack Simulation, and SIEM validation.

• cybersecurity
• docker
• fastapi
• llm

A malware dataset curation tool which helps identify packed samples.

• malware
• packer
• security
• peid

Packing detection tool for PE files

• detector
• pe-file
• pe-format
• peid

A simple many-rules to many-files YARA scanner for incident response or malware zoos.

• yara
• yara-scanner
• incident-response
• dfir

Attack tool for altering packed samples so that they evade static packing detection

• adversarial
• attack-defense
• evasion
• executable-packing

CalmAV wrapper for elixir

• clamav
• elixir
• antivirus
• malware-detection