Repository Index

Free, open-source check for traces of mercenary spyware (Pegasus, Predator, Graphite, Candiru and more) on computers, Android phones and iPhone backups. Double-click apps for Windows, Mac and Linux, in 27 languages.

Loki - Simple IOC and YARA Scanner

• python
• yara
• signature
• scanner

Noriben - Portable, Simple, Malware Analysis Sandbox

Automatic and platform-independent unpacker for Windows binaries based on emulation

• reverse-engineering
• unpacker
• pefile
• windows

Script to create templates to use with VirtualBox to make vm detection harder

• virtualbox
• antivm
• sandbox
• malware-analysis

Simple Bash IOC Scanner

WinDBG Anti-RootKit Extension

• kernel-mode
• c-plus-plus
• malware
• malware-analysis

Sandbox for semi-automatic Javascript malware analysis, deobfuscation and payload extraction. Written for Node.js

• malware-samples
• wscript
• deobfuscation
• angler

DC3 Malware Configuration Parser (DC3-MWCP) is a framework for parsing configuration information from malware. The information extracted from malware includes items such as addresses, passwords, filenames, and mutex names.

• python
• malware-analysis
• automation
• config-dump

VolatilityBot – An automated memory analyzer for malware samples and memory dumps

Django application that performs SAST and Malware Analysis for Android APKs

• android-security
• sast
• malware-analysis
• code-security

simple YARA-based IOC scanner

• yara
• ioc
• security
• incident-response

The repository host gives no description.

Python implementation of the Packed Executable iDentifier (PEiD)

• peid
• peid-signature
• pe-file
• pe-files

Simple framework to extract "actionable" data from Android malware (C&Cs, phone numbers etc.)

Sample staging & detonation utility to be used in combination with Cuckoo Sandbox.

Builds json representation of PDF malware sample

Analysis tool for estimating the likelihood that a binary contains compressed or encrypted bytes

• entropy
• pe-file
• pe-files
• pe-format

A malware dataset curation tool which helps identify packed samples.

• malware
• packer
• security
• peid

A simple many-rules to many-files YARA scanner for incident response or malware zoos.

• yara
• yara-scanner
• incident-response
• dfir

Yet another implementation of PEiD with yara

• binary-analysis
• yara
• yara-rules
• peid

Detect the Shai Hulud 2.0 npm supply chain attack (796+ packages). Scans for malicious files, hashes, and compromised ecosystems. Fast, accurate scanner.

• cdn
• cve
• polyfill
• polyfill-io

Implementation of the packing detection heuristic from the paper "Packed PE File Detection for Malware Forensics" of Han et al.

• binary-analysis
• entropy
• entrypoint
• executable-packing

A simple tool to organise large malicious/benign files into a organised Structure.

• malware
• malware-analysis
• malware-research
• clean-file