Repository Index

Scan files or process memory for CobaltStrike beacons and parse their configuration

Dynamic unpacker based on PE-sieve

• libpeconv
• pe-sieve
• memory-forensics
• malware-unpacker

WinDBG Anti-RootKit Extension

• kernel-mode
• c-plus-plus
• malware
• malware-analysis

Volatility plugin for extracts configuration data of known malware

• malware
• volatility
• forensics
• python

Limon is a sandbox developed as a research project written in python, which automatically collects, analyzes, and reports on the run time indicators of Linux malware. It allows one to inspect Linux malware before execution, during execution, and after execution (post-mortem analysis) by performing static, dynamic and memory analysis using open source tools

C++ application that uses memory and code hooks to detect packers

VolatilityBot – An automated memory analyzer for malware samples and memory dumps