Repository Index

the fastest and most powerful android decompiler(native tool working without Java VM) for the APK, DEX, ODEX, OAT, JAR, AAR, and CLASS file. which supports malicious behavior detection, privacy leaking detection, vulnerability detection, path solving, packer identification, variable tracking, deobfuscation, python&java scripts, device memory extraction, data decryption, and encryption, etc.

• decompiler
• vulnerability-scanners
• malware-analysis
• security-audit

Free, offline checks for known mercenary spyware on Windows, Mac, Linux, iPhone and Android - plus the doors left open, suspicious links, emails, files and QR codes, your accounts, home network and nearby trackers. Apps with a window, 27 languages. Nothing leaves your computer.

Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).

• pe-format
• hooking
• pe-dumper
• pe-analyzer

Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).

• pe-sieve
• anti-malware
• malware-analysis
• malware-detection

All-in-One malware analysis tool.

• linux
• malware-analysis
• python3
• static-analysis

Malicious HTTP traffic explorer

PEframe is a open source tool to perform static analysis on Portable Executable malware and malicious MS Office documents.

Yet another static code analyzer for malicious Android applications

Incident Response - Fast suspicious file finder

• dfir
• investigation
• incident-response
• threat-hunting

Wraps around various tools and provides some additional checks/information to produce a centralized report of a PE file.

A modular Python application to pull intelligence about malicious files

• malware-analysis
• malware-research
• investigation
• cybersecurity

The current repository contains all the scripts needed to build kernel-mode mac-a-mal malicious activity hooking on macOS.

• macos

YALIH (Yet Another Low Interaction Honeyclient) is a low Interaction Client honeypot designed to detect malicious websites through signature, anomaly and pattern matching techniques

Based on the Volatility framework, this script will run various plugins as well as create a timeline, or use YARA/ClamAV/VirusTotal to find badness.

Detect the Shai Hulud 2.0 npm supply chain attack (796+ packages). Scans for malicious files, hashes, and compromised ecosystems. Fast, accurate scanner.

• cdn
• cve
• polyfill
• polyfill-io

A simple tool to organise large malicious/benign files into a organised Structure.

• malware
• malware-analysis
• malware-research
• clean-file