An open-source user mode debugger for Windows. Optimized for reverse engineering and malware analysis.
Repository Index
59,621 visible repositories in the index
1–24 of 39 · Most stars
IntelOwl: manage your Threat Intelligence at scale
- security-tools
- python
- threat-intelligence
- ioc
Free, open-source check for traces of mercenary spyware (Pegasus, Predator, Graphite, Candiru and more) on computers, Android phones and iPhone backups. Double-click apps for Windows, Mac and Linux, in 27 languages.
Malwoverview is a first response tool for threat hunting across VirusTotal, Hybrid Analysis, URLHaus, Polyswarm, Malshare, Alien Vault, Malpedia, Malware Bazaar, ThreatFox, Triage, IPInfo, Shodan, AbuseIPDB, GreyNoise, URLScan.io, Whois/RDAP, NIST, and VulnCheck. Supports LLM enrichment, IOC extraction, YARA scanning, and Android analysis.
- malware
- virustotal
- malpedia
- urlhaus
Android Application Identifier for Packers, Protectors, Obfuscators and Oddities - PEiD for Android
- android
- antivirus
- machine-learning
- malware-detection
Security sensor for realtime threat detection and protection
Elastic Security detection content for Endpoint
A Virtual Machine For Assessing Android applications, Reverse Engineering and Malware Analysis
- mobile-security
- android
- malware-analyzer
- penetration-testing
Interactive Delphi Reconstructor
Malcom - Malware Communications Analyzer
- malware
- network-traffic
- pcap
- threat-intelligence
Scan files or process memory for CobaltStrike beacons and parse their configuration
Dynamic unpacker based on PE-sieve
- libpeconv
- pe-sieve
- memory-forensics
- malware-unpacker
DECAF (short for Dynamic Executable Code Analysis Framework) is a binary analysis platform based on QEMU. This is also the home of the DroidScope dynamic Android malware analysis platform. DroidScope is now an extension to DECAF.
- binary-analysis
- taint-analysis
Sandboxed Execution Environment
Script to create templates to use with VirtualBox to make vm detection harder
- virtualbox
- antivm
- sandbox
- malware-analysis
WinDBG Anti-RootKit Extension
- kernel-mode
- c-plus-plus
- malware
- malware-analysis
Yet another static code analyzer for malicious Android applications
Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.
- blue-team
- detection-engineering
- edr
- endpoint-detection
Volatility plugin for extracts configuration data of known malware
Drltrace is a library calls tracer for Windows and Linux applications.
- dbi
- malware-analysis
- malware-detection
- api-trace
Limon is a sandbox developed as a research project written in python, which automatically collects, analyzes, and reports on the run time indicators of Linux malware. It allows one to inspect Linux malware before execution, during execution, and after execution (post-mortem analysis) by performing static, dynamic and memory analysis using open source tools
A framework for automated extraction of static and dynamic features from Android applications
- android-malware-detection
- android-analysis
File Scanning Framework
- security-tools
- network-defense
- file-analysis
- file-analyzer
Incident Response - Fast suspicious file finder
- dfir
- investigation
- incident-response
- threat-hunting