Repository Index

Simple framework to extract "actionable" data from Android malware (C&Cs, phone numbers etc.)

Contains materials for my technical presentation exploring Linux malware tradecraft—from userland and fileless techniques to kernel rootkits, ftrace, eBPF, and defensive strategies.

Malware/IOC ingestion and processing engine

A honeypot for malware that propagates via USB storage devices

Code for our DLS'21 paper - BODMAS: An Open Dataset for Learning based Temporal Analysis of PE Malware. BODMAS is short for Blue Hexagon Open Dataset for Malware AnalysiS.

• malware
• pe-malware
• malware-dataset
• malware-research

Ragpicker is a Plugin based malware crawler with pre-analysis and reporting functionalities. Use this tool if you are testing antivirus products, collecting malware for another analyzer/zoo.

Effects of packers on machine-learning-based malware classifiers that use only static analysis

Tool to help guess a files 256 byte XOR key by using frequency analysis

• frequency-analysis
• python
• xor
• malware

Awesome Splunk SPL hunt queries that can be used to detect the latest vulnerability exploitation attempts & subsequent compromise

• detection
• splunk
• bpfdoor
• vulnerability

Docker image gathering packers and tools for making datasets of packed executables and training machine learning models for packing detection

• docker-image
• executable-packing
• malware-packers
• research-platform

Sublime Malware Research Tool

An ICAP Server with yara scanner for URL and content.

• python
• icap-server
• yara
• malware-analysis

A curated dataset of malware and benign Windows executable samples for malware researchers

• machine-learning
• deep-learning
• malware-research
• malware-detection

HoneyHTTPD is a Python-based web server honeypot/service imitation builder. Great for honeypots or faking HTTP services.

• python
• honeypot
• honeypot-http
• python-web

Builds json representation of PDF malware sample

Analysis tool for estimating the likelihood that a binary contains compressed or encrypted bytes

• entropy
• pe-file
• pe-files
• pe-format

Dataset of packed PE samples

• dataset
• pe-files
• upx
• samples

Zero-overhead eBPF process tracer for Linux malware triage and incident response. Traces syscalls, network, and file events per-process without strace overhead.

• bpf
• ebpf
• forensics
• golang

Cryptographic Dataset Generation & Modelling Framework

• cryptography
• deep-learning
• deep-neural-networks
• machine-learning

Android Malware Behavior Deleter

• android
• malware
• antivirus
• editor

Self-hosted AI-assisted CTI-to-detection workbench for ATT&CK mapping, IOC/CVE intelligence, Threat Radar, malware triage, Attack Simulation, and SIEM validation.

• cybersecurity
• docker
• fastapi
• llm

A malware dataset curation tool which helps identify packed samples.

• malware
• packer
• security
• peid

Packing detection tool for PE files

• detector
• pe-file
• pe-format
• peid

A simple many-rules to many-files YARA scanner for incident response or malware zoos.

• yara
• yara-scanner
• incident-response
• dfir