Repository Index

Randomly changes Win32/64 PE Files for 'safer' uploading to malware and sandbox sites.

BluePill: Neutralizing Anti-Analysis Behavior in Malware Dissection (Black Hat Europe 2019, IEEE TIFS 2020)

• malware-analysis
• reverse-engineering
• debugger
• malware

A modular Python application to pull intelligence about malicious files

• malware-analysis
• malware-research
• investigation
• cybersecurity

Automated malware unpacker

Detect and log CVE-2019-19781 scan and exploitation attempts.

Simple framework to extract "actionable" data from Android malware (C&Cs, phone numbers etc.)

Malware/IOC ingestion and processing engine

Android small footprint inspection tool

A honeypot for malware that propagates via USB storage devices

Ragpicker is a Plugin based malware crawler with pre-analysis and reporting functionalities. Use this tool if you are testing antivirus products, collecting malware for another analyzer/zoo.

Tool to help guess a files 256 byte XOR key by using frequency analysis

• frequency-analysis
• python
• xor
• malware

The current repository contains all the scripts needed to build kernel-mode mac-a-mal malicious activity hooking on macOS.

• macos

CTF in a box. Minimal setup required. (not production-ready yet)

A set of Maltego transforms for VirusTotal Public API v2.0. This set has the added functionality of caching queries on a daily basis to speed up resolutions.

Awesome Splunk SPL hunt queries that can be used to detect the latest vulnerability exploitation attempts & subsequent compromise

• detection
• splunk
• bpfdoor
• vulnerability

YALIH (Yet Another Low Interaction Honeyclient) is a low Interaction Client honeypot designed to detect malicious websites through signature, anomaly and pattern matching techniques

Docker image gathering packers and tools for making datasets of packed executables and training machine learning models for packing detection

• docker-image
• executable-packing
• malware-packers
• research-platform

Powerful Session Management for Kemal applications

• kemal
• session
• crystal
• middleware

Sublime Malware Research Tool

A minimalist Crystal authorization system inspired by https://github.com/varvet/pundit.

• praetorian
• crystal
• authorization
• authorisation

An ICAP Server with yara scanner for URL and content.

• python
• icap-server
• yara
• malware-analysis

HoneyHTTPD is a Python-based web server honeypot/service imitation builder. Great for honeypots or faking HTTP services.

• python
• honeypot
• honeypot-http
• python-web

Builds json representation of PDF malware sample

A short and small memory forensics helper.

• python
• volatility
• memory-forensics