Repository Index

Repository of yara rules

the fastest and most powerful android decompiler(native tool working without Java VM) for the APK, DEX, ODEX, OAT, JAR, AAR, and CLASS file. which supports malicious behavior detection, privacy leaking detection, vulnerability detection, path solving, packer identification, variable tracking, deobfuscation, python&java scripts, device memory extraction, data decryption, and encryption, etc.

• decompiler
• vulnerability-scanners
• malware-analysis
• security-audit

Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).

• pe-format
• hooking
• pe-dumper
• pe-analyzer

Scan files or process memory for CobaltStrike beacons and parse their configuration

Dynamic unpacker based on PE-sieve

• libpeconv
• pe-sieve
• memory-forensics
• malware-unpacker

WinDBG Anti-RootKit Extension

• kernel-mode
• c-plus-plus
• malware
• malware-analysis

Volatility plugin for extracts configuration data of known malware

• malware
• volatility
• forensics
• python

Limon is a sandbox developed as a research project written in python, which automatically collects, analyzes, and reports on the run time indicators of Linux malware. It allows one to inspect Linux malware before execution, during execution, and after execution (post-mortem analysis) by performing static, dynamic and memory analysis using open source tools

C++ application that uses memory and code hooks to detect packers

VolatilityBot – An automated memory analyzer for malware samples and memory dumps

Read-only check for traces of the November 2026 NIKKE PC launcher compromise. Windows, Linux (Proton, Steam Deck) and macOS.

• iced
• incident-response
• indicators-of-compromise
• infostealer

The current repository contains all the scripts needed to build kernel-mode mac-a-mal malicious activity hooking on macOS.

• macos