Repository Index

Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.

• static-analysis
• dynamic-analysis
• mobsf
• android-security

Program for determining types of files for Windows, Linux and MacOS.

• debugger
• detect
• unpacker
• disassembler

The pattern matching swiss knife

FLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.

• malware
• deobfuscation
• strings
• flare

BinaryAlert: Serverless, Real-time & Retroactive Malware Detection.

• security
• yara
• serverless
• terraform

A Virtual Machine For Assessing Android applications, Reverse Engineering and Malware Analysis

• mobile-security
• android
• malware-analyzer
• penetration-testing

Scan files or process memory for CobaltStrike beacons and parse their configuration

HaboMalHunter is a sub-project of Habo Malware Analysis System (https://habo.qq.com), which can be used for automated malware analysis and security assessment on the Linux system.

• malware-analysis
• dynamic-analysis
• security
• linux

Java library to analyse Portable Executable files with a special focus on malware analysis and PE malformation robustness

AVClass malware labeling tool

Drltrace is a library calls tracer for Windows and Linux applications.

• dbi
• malware-analysis
• malware-detection
• api-trace

A Tool for Automatic Analysis of Malware Behavior

• machine-learning
• clustering
• classification
• malware-analysis

DC3 Malware Configuration Parser (DC3-MWCP) is a framework for parsing configuration information from malware. The information extracted from malware includes items such as addresses, passwords, filenames, and mutex names.

• python
• malware-analysis
• automation
• config-dump

Open-source cross-platform defensive spyware, stalkerware and surveillance software detector

• anti-surveillance
• dfir
• keylogger-detector
• privacy

The pattern matching swiss knife

BluePill: Neutralizing Anti-Analysis Behavior in Malware Dissection (Black Hat Europe 2019, IEEE TIFS 2020)

• malware-analysis
• reverse-engineering
• debugger
• malware

Process HTTP Pcaps With YARA

Tool to help guess a files 256 byte XOR key by using frequency analysis

• frequency-analysis
• python
• xor
• malware

Advanced analysis software for APK payloads created by RATs.

• apk
• remoteaccesstrojan
• reverse-engineering
• aapt

Zero-overhead eBPF process tracer for Linux malware triage and incident response. Traces syscalls, network, and file events per-process without strace overhead.

• bpf
• ebpf
• forensics
• golang

Analysis tool for estimating the likelihood that a binary contains compressed or encrypted bytes

• entropy
• pe-file
• pe-files
• pe-format

Based on the Volatility framework, this script will run various plugins as well as create a timeline, or use YARA/ClamAV/VirusTotal to find badness.

A tool for detecting viruses and NSFW material in WARC files

• antivirus
• nsfw-classifier
• warc
• warc-safe