Repository Index

YARA signature and IOC database for my scanners and tools

• signature
• yara-rules
• ioc
• scanner

One of a few malware collections on the GitHub.

Dynamic unpacker based on PE-sieve

• libpeconv
• pe-sieve
• memory-forensics
• malware-unpacker

DECAF (short for Dynamic Executable Code Analysis Framework) is a binary analysis platform based on QEMU. This is also the home of the DroidScope dynamic Android malware analysis platform. DroidScope is now an extension to DECAF.

• binary-analysis
• taint-analysis

Automatic and platform-independent unpacker for Windows binaries based on emulation

• reverse-engineering
• unpacker
• pefile
• windows

A machine learning tool that ranks strings based on their relevance for malware analysis.

• machine-learning
• fireeye-flare
• strings
• malware-analysis

simple YARA-based IOC scanner

• yara
• ioc
• security
• incident-response

Ragpicker is a Plugin based malware crawler with pre-analysis and reporting functionalities. Use this tool if you are testing antivirus products, collecting malware for another analyzer/zoo.

Docker image gathering packers and tools for making datasets of packed executables and training machine learning models for packing detection

• docker-image
• executable-packing
• malware-packers
• research-platform

Zero-overhead eBPF process tracer for Linux malware triage and incident response. Traces syscalls, network, and file events per-process without strace overhead.

• bpf
• ebpf
• forensics
• golang

Based on the Volatility framework, this script will run various plugins as well as create a timeline, or use YARA/ClamAV/VirusTotal to find badness.

A malware dataset curation tool which helps identify packed samples.

• malware
• packer
• security
• peid

Advanced eBPF-driven Digital Forensics and Incident Response (DFIR) framework for live Golang malware analysis, threat hunting, and observability.

• bpf
• ebpf
• forensics
• goroutine