Repository Index

A modular Python application to pull intelligence about malicious files

• malware-analysis
• malware-research
• investigation
• cybersecurity

NTFUZZ: Enabling Type-Aware Kernel Fuzzing on Windows with Static Binary Analysis (IEEE S&P '21)

• fuzzer
• fuzzing
• kernel-fuzzer
• windows-kernel

Ragpicker is a Plugin based malware crawler with pre-analysis and reporting functionalities. Use this tool if you are testing antivirus products, collecting malware for another analyzer/zoo.

Tool to help guess a files 256 byte XOR key by using frequency analysis

• frequency-analysis
• python
• xor
• malware

Python API Monitor for Android apps

• android
• frida
• api
• monitoring

🪓 High-Speed Log Analysis & Forensics Tool - Part of NullSec Toolkit

• c
• forensics
• log-analysis
• security

AI-powered platform for OSINT intelligence analysis. Features archive discovery with hypothesis-driven investigation, GLiNER entity extraction, Mapbox geospatial visualization, network analysis, and document processing. Built with FastAPI, Next.js, Weaviate, and DSPy.

• ai-agents
• document-processing
• dspy
• entity-extraction

Docker image gathering packers and tools for making datasets of packed executables and training machine learning models for packing detection

• docker-image
• executable-packing
• malware-packers
• research-platform

Advanced analysis software for APK payloads created by RATs.

• apk
• remoteaccesstrojan
• reverse-engineering
• aapt

An ICAP Server with yara scanner for URL and content.

• python
• icap-server
• yara
• malware-analysis

HoneyHTTPD is a Python-based web server honeypot/service imitation builder. Great for honeypots or faking HTTP services.

• python
• honeypot
• honeypot-http
• python-web

Zero-overhead eBPF process tracer for Linux malware triage and incident response. Traces syscalls, network, and file events per-process without strace overhead.

• bpf
• ebpf
• forensics
• golang

Analysis tool for estimating the likelihood that a binary contains compressed or encrypted bytes

• entropy
• pe-file
• pe-files
• pe-format

Forensic tool for acquisition, triage and analysis of remote block devices via iSCSI protocol.

• acquisition
• cybersecurity
• forensics
• iscsi

Cryptographic Dataset Generation & Modelling Framework

• cryptography
• deep-learning
• deep-neural-networks
• machine-learning

Rule Processor Y is a next-gen Rule processor with complex multibyte character support built to support Hashcat

• cybersecurity
• hashcat
• hashcat-rules
• johntheripper

Encrypts 64-bit elf files that decrypt at runtime.

• elf64
• linux
• elf-binaries
• elf-parser

Create n-grams of wordlists based on words, characters, or charsets to use in offline password attacks and data analysis

• hashcat
• jtr
• mdxfind
• ngram

Packing detection tool for PE files

• detector
• pe-file
• pe-format
• peid

Attack tool for altering packed samples so that they evade static packing detection

• adversarial
• attack-defense
• evasion
• executable-packing

Yet another implementation of PEiD with yara

• binary-analysis
• yara
• yara-rules
• peid

Real-time network traffic analysis in your terminal.

• cli
• ddos
• ddos-detection
• go

🛡️ Static security scanner (SAST) for Ansible playbooks, roles, and collections. 1,000+ rules across 30+ categories detecting malicious code, RCE, hardcoded credentials, and supply-chain risk. Outputs SARIF, CycloneDX SBOM, and GitLab SAST. SLSA Build Level 3, Sigstore-signed.

• ansible
• ansible-playbook
• devsecops
• infrastructure-as-code

Implementation of the packing detection heuristic from the paper "Packed PE File Detection for Malware Forensics" of Han et al.

• binary-analysis
• entropy
• entrypoint
• executable-packing