Repository Index

The FLARE team's open-source tool to identify capabilities in executable files.

• malware-analysis
• reverse-engineering
• binary-analysis
• threat-intelligence

Security sensor for realtime threat detection and protection

• windows
• windows-kernel
• instrumentation
• security

Malcom - Malware Communications Analyzer

• malware
• network-traffic
• pcap
• threat-intelligence

A machine learning tool that ranks strings based on their relevance for malware analysis.

• machine-learning
• fireeye-flare
• strings
• malware-analysis

HaboMalHunter is a sub-project of Habo Malware Analysis System (https://habo.qq.com), which can be used for automated malware analysis and security assessment on the Linux system.

• malware-analysis
• dynamic-analysis
• security
• linux

DC3 Malware Configuration Parser (DC3-MWCP) is a framework for parsing configuration information from malware. The information extracted from malware includes items such as addresses, passwords, filenames, and mutex names.

• python
• malware-analysis
• automation
• config-dump

Incident Response - Fast suspicious file finder

• dfir
• investigation
• incident-response
• threat-hunting

Malware Analysis Tool using Function Level Fuzzy Hashing

simple YARA-based IOC scanner

• yara
• ioc
• security
• incident-response

Open-source cross-platform defensive spyware, stalkerware and surveillance software detector

• anti-surveillance
• dfir
• keylogger-detector
• privacy

Scalable Binary Data Extraction in Hadoop

A modular Python application to pull intelligence about malicious files

• malware-analysis
• malware-research
• investigation
• cybersecurity

Ragpicker is a Plugin based malware crawler with pre-analysis and reporting functionalities. Use this tool if you are testing antivirus products, collecting malware for another analyzer/zoo.

Tool to help guess a files 256 byte XOR key by using frequency analysis

• frequency-analysis
• python
• xor
• malware

Advanced analysis software for APK payloads created by RATs.

• apk
• remoteaccesstrojan
• reverse-engineering
• aapt

Analysis tool for estimating the likelihood that a binary contains compressed or encrypted bytes

• entropy
• pe-file
• pe-files
• pe-format

Zero-overhead eBPF process tracer for Linux malware triage and incident response. Traces syscalls, network, and file events per-process without strace overhead.

• bpf
• ebpf
• forensics
• golang

A malware dataset curation tool which helps identify packed samples.

• malware
• packer
• security
• peid

A simple many-rules to many-files YARA scanner for incident response or malware zoos.

• yara
• yara-scanner
• incident-response
• dfir