Repository Index

The pattern matching swiss knife

Free, open-source check for traces of mercenary spyware (Pegasus, Predator, Graphite, Candiru and more) on computers, Android phones and iPhone backups. Double-click apps for Windows, Mac and Linux, in 27 languages.

FLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.

• malware
• deobfuscation
• strings
• flare

Loki - Simple IOC and YARA Scanner

• python
• yara
• signature
• scanner

Android Application Identifier for Packers, Protectors, Obfuscators and Oddities - PEiD for Android

• android
• antivirus
• machine-learning
• malware-detection

Security sensor for realtime threat detection and protection

• windows
• windows-kernel
• instrumentation
• security

A static analyzer for PE executables.

• malware
• static
• analysis
• pe

Script to create templates to use with VirtualBox to make vm detection harder

• virtualbox
• antivm
• sandbox
• malware-analysis

HaboMalHunter is a sub-project of Habo Malware Analysis System (https://habo.qq.com), which can be used for automated malware analysis and security assessment on the Linux system.

• malware-analysis
• dynamic-analysis
• security
• linux

Malicious HTTP traffic explorer

WinDBG Anti-RootKit Extension

• kernel-mode
• c-plus-plus
• malware
• malware-analysis

PEframe is a open source tool to perform static analysis on Portable Executable malware and malicious MS Office documents.

Modular file scanning/analysis framework

• python
• analytic-machines
• analysis-framework
• python-script

Java library to analyse Portable Executable files with a special focus on malware analysis and PE malformation robustness

Yet another static code analyzer for malicious Android applications

Sandbox for semi-automatic Javascript malware analysis, deobfuscation and payload extraction. Written for Node.js

• malware-samples
• wscript
• deobfuscation
• angler

Limon is a sandbox developed as a research project written in python, which automatically collects, analyzes, and reports on the run time indicators of Linux malware. It allows one to inspect Linux malware before execution, during execution, and after execution (post-mortem analysis) by performing static, dynamic and memory analysis using open source tools

A Tool for Automatic Analysis of Malware Behavior

• machine-learning
• clustering
• classification
• malware-analysis

C++ application that uses memory and code hooks to detect packers

Incident Response - Fast suspicious file finder

• dfir
• investigation
• incident-response
• threat-hunting

Automatic deployment of Cuckoo Sandbox malware lab using Packer and Vagrant

Django application that performs SAST and Malware Analysis for Android APKs

• android-security
• sast
• malware-analysis
• code-security

Android Loadable Kernel Modules - mostly used for reversing and debugging on controlled systems/emulators

• loadable-kernel-modules
• android-lkms
• emulators
• kernel

Wraps around various tools and provides some additional checks/information to produce a centralized report of a PE file.