Repository Index

Malware Configuration And Payload Extraction

• configs
• debugging-tools
• malware
• malware-analysis

Security sensor for realtime threat detection and protection

• windows
• windows-kernel
• instrumentation
• security

DECAF (short for Dynamic Executable Code Analysis Framework) is a binary analysis platform based on QEMU. This is also the home of the DroidScope dynamic Android malware analysis platform. DroidScope is now an extension to DECAF.

• binary-analysis
• taint-analysis

Drltrace is a library calls tracer for Windows and Linux applications.

• dbi
• malware-analysis
• malware-detection
• api-trace

Limon is a sandbox developed as a research project written in python, which automatically collects, analyzes, and reports on the run time indicators of Linux malware. It allows one to inspect Linux malware before execution, during execution, and after execution (post-mortem analysis) by performing static, dynamic and memory analysis using open source tools

File Scanning Framework

• security-tools
• network-defense
• file-analysis
• file-analyzer

Wraps around various tools and provides some additional checks/information to produce a centralized report of a PE file.

Open-source cross-platform defensive spyware, stalkerware and surveillance software detector

• anti-surveillance
• dfir
• keylogger-detector
• privacy

Python implementation of the Packed Executable iDentifier (PEiD)

• peid
• peid-signature
• pe-file
• pe-files

A Python library and command line tools to provide interactive log visualization.

• cybersecurity
• investigation
• malware-analysis
• malware-research

Docker image gathering packers and tools for making datasets of packed executables and training machine learning models for packing detection

• docker-image
• executable-packing
• malware-packers
• research-platform

Analysis tool for estimating the likelihood that a binary contains compressed or encrypted bytes

• entropy
• pe-file
• pe-files
• pe-format

Zero-overhead eBPF process tracer for Linux malware triage and incident response. Traces syscalls, network, and file events per-process without strace overhead.

• bpf
• ebpf
• forensics
• golang