Repository Index

Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.

• static-analysis
• dynamic-analysis
• mobsf
• android-security

The FLARE team's open-source tool to identify capabilities in executable files.

• malware-analysis
• reverse-engineering
• binary-analysis
• threat-intelligence

Security sensor for realtime threat detection and protection

• windows
• windows-kernel
• instrumentation
• security

Elastic Security detection content for Endpoint

BinaryAlert: Serverless, Real-time & Retroactive Malware Detection.

• security
• yara
• serverless
• terraform

A Virtual Machine For Assessing Android applications, Reverse Engineering and Malware Analysis

• mobile-security
• android
• malware-analyzer
• penetration-testing

A static analyzer for PE executables.

• malware
• static
• analysis
• pe

DECAF (short for Dynamic Executable Code Analysis Framework) is a binary analysis platform based on QEMU. This is also the home of the DroidScope dynamic Android malware analysis platform. DroidScope is now an extension to DECAF.

• binary-analysis
• taint-analysis

Sandboxed Execution Environment

• python
• sandbox
• malware-analysis
• malware-research

Automatic and platform-independent unpacker for Windows binaries based on emulation

• reverse-engineering
• unpacker
• pefile
• windows

HaboMalHunter is a sub-project of Habo Malware Analysis System (https://habo.qq.com), which can be used for automated malware analysis and security assessment on the Linux system.

• malware-analysis
• dynamic-analysis
• security
• linux

PEframe is a open source tool to perform static analysis on Portable Executable malware and malicious MS Office documents.

Java library to analyse Portable Executable files with a special focus on malware analysis and PE malformation robustness

Volatility plugin for extracts configuration data of known malware

• malware
• volatility
• forensics
• python

Limon is a sandbox developed as a research project written in python, which automatically collects, analyzes, and reports on the run time indicators of Linux malware. It allows one to inspect Linux malware before execution, during execution, and after execution (post-mortem analysis) by performing static, dynamic and memory analysis using open source tools

File Scanning Framework

• security-tools
• network-defense
• file-analysis
• file-analyzer

Django application that performs SAST and Malware Analysis for Android APKs

• android-security
• sast
• malware-analysis
• code-security

Android Mobile Device Hardening

• forensic
• security
• hardening
• android-security

simple YARA-based IOC scanner

• yara
• ioc
• security
• incident-response

Open-source cross-platform defensive spyware, stalkerware and surveillance software detector

• anti-surveillance
• dfir
• keylogger-detector
• privacy

Python implementation of the Packed Executable iDentifier (PEiD)

• peid
• peid-signature
• pe-file
• pe-files

A Python library and command line tools to provide interactive log visualization.

• cybersecurity
• investigation
• malware-analysis
• malware-research

ebpfkit-monitor is a tool that detects and protects against eBPF powered rootkits

• linux
• security
• kernel
• rootkit

A modular Python application to pull intelligence about malicious files

• malware-analysis
• malware-research
• investigation
• cybersecurity