1.kevoreilly / CAPEv2
Malware Configuration And Payload Extraction
- configs
- debugging-tools
- malware
- malware-analysis
- malware-research
- reverse-engineering
- +3 more
+497 stars
from 3,153 · score 6.21
Trending repositories
Ranked by Attention Score: stars gained over the last 180 complete days
18 repositories by Attention Score · May 9, 2026 – Nov 4, 2026 (UTC)
2.rednaga / APKiD
Android Application Identifier for Packers, Protectors, Obfuscators and Oddities - PEiD for Android
- android
- antivirus
- machine-learning
- malware-detection
- malware-analysis
- malware-research
- +8 more
+151 stars
from 2,461 · score 5.02
3.rabbitstack / fibratus
Security sensor for realtime threat detection and protection
+115 stars
from 2,451 · score 4.75
4.elastic / protections-artifacts
Elastic Security detection content for Endpoint
+90 stars
from 1,419 · score 4.51
5.tklengyel / drakvuf
DRAKVUF Black-box Binary Analysis
- malware-analysis
- virtualization
- xen
- introspection
+64 stars
from 1,226 · score 4.17
6.Rurik / Noriben
Noriben - Portable, Simple, Malware Analysis Sandbox
+61 stars
from 1,260 · score 4.13
7.Neo23x0 / yarGen
yarGen is a generator for YARA rules
- python
- yara
- malware
- malware-research
- malware-analysis
- malwareanalysis
+46 stars
from 1,778 · score 3.85
8.cuckoosandbox / cuckooArchived
Cuckoo Sandbox is an automated dynamic malware analysis system
+34 stars
from 5,925 · score 3.56
9.elastic / emberArchived
Elastic Malware Benchmark for Empowering Researchers
+23 stars
from 1,147 · score 3.18
10.rafosw / APKdevastate
Advanced analysis software for APK payloads created by RATs.
- apk
- remoteaccesstrojan
- reverse-engineering
- aapt
- android
- security
- +1 more
+17 stars
from 48 · score 2.89
11.dod-cyber-crime-center / DC3-MWCP
DC3 Malware Configuration Parser (DC3-MWCP) is a framework for parsing configuration information from malware. The information extracted from malware includes items such as addresses, passwords, filenames, and mutex names.
- python
- malware-analysis
- automation
- config-dump
- framework
- malware-automation
+10 stars
from 344 · score 2.40
12.tomchop / malcom
Malcom - Malware Communications Analyzer
- malware
- network-traffic
- pcap
- threat-intelligence
- malware-analysis
- infosec
- +1 more
+7 stars
from 1,167 · score 2.08
13.codeyourweb / fastfinder
Incident Response - Fast suspicious file finder
- dfir
- investigation
- incident-response
- threat-hunting
+6 stars
from 255 · score 1.95
14.viper-framework / viperArchived
Binary analysis and management framework
+5 stars
from 1,553 · score 1.79
15.Tencent / HaboMalHunter
HaboMalHunter is a sub-project of Habo Malware Analysis System (https://habo.qq.com), which can be used for automated malware analysis and security assessment on the Linux system.
- malware-analysis
- dynamic-analysis
- security
- linux
- static-analysis
- elf
+4 stars
from 747 · score 1.61
16.JPCERTCC / MalConfScan
Volatility plugin for extracts configuration data of known malware
+3 stars
from 495 · score 1.39
17.swwwolf / wdbgark
WinDBG Anti-RootKit Extension
- kernel-mode
- c-plus-plus
- malware
- malware-analysis
- malware-research
- forensic-analysis
- +14 more
+2 stars
from 640 · score 1.10
18.keithjjones / visualize_logs
A Python library and command line tools to provide interactive log visualization.
- cybersecurity
- investigation
- malware-analysis
- malware-research
+1 stars
from 145 · score 0.69