603 matches found
imaginaryC2
Imaginary C2 author: Felix Weyne website Twitter Imaginary C2 is a python tool which aims to help in the behavioral network analysis of malware. Imaginary C2 hosts a HTTP server which captures HTTP requests towards selectively chosen domains/IPs. Additionally, the tool aims to make it easy to...
reverse-engineering
Reverse Engineering resources A curated list of awesome reversing resources Awesome Reversing Books Courses Practice Hex Editors Binary Format Disassemblers Binary Analysis Bytecode Analysis Import Reconstruction Dynamic Analysis Debugging Mac Decrypt Document Analysis Scripting Android Yara Book...
quark-engine
Malware Family Analysis Report Showcase Quick Start Step 1. Install via PyPi Install the latest version of Quark Engine: root@kitploit: $ pip3 install -U quark-engine Step 2. Download Latest Rules Fetch the latest rule database: root@kitploit: $ freshquark Step 3. Run Summary Report Analyze an AP...
Memory-analysis
рдореЗрдореЛрд░реА-рд╡рд┐рд╢реНрд▓реЗрд╖рдг рдЗрд╕рдореЗрдВ рдореЗрдореЛрд░реА рдореЗрдВ рдореИрд▓рд╡реЗрдпрд░ рдФрд░ рдлреЛрд░реЗрдВрд╕рд┐рдХ рд╡рд┐рд╢реНрд▓реЗрд╖рдг рдХрд░рдиреЗ рдХреЗ рд▓рд┐рдП рдЙрдкрдХрд░рдг рд╢рд╛рдорд┐рд▓ рд╣реИрдВред рдкреНрд▓рдЧрдЗрдиреНрд╕: Dyrescan.py - рдореЗрдореЛрд░реА рдореЗрдВ Dyreconfig рдХреЛ рдкрд╛рд░реНрд╕ рдХрд░рддрд╛ рд╣реИред Rat9002.py - рдореЗрдореЛрд░реА рдореЗрдВ 9002 rat рдХреЙрдиреНрдлрд╝рд┐рдЧ рдХреЛ рдкрд╛рд░реНрд╕ рдХрд░рддрд╛ рд╣реИред plugx.py - рдореЗрдореЛрд░реА рдореЗрдВ plugx рдХреЙрдиреНрдлрд╝рд┐рдЧ рдХреЛ рдкрд╛рд░реНрд╕ рдХрд░рддрд╛ рд╣реИ рдХреЙрдиреНрдлрд╝рд┐рдЧ рдЖрдХрд╛рд░: 0x170c рдХреЛ рднреА...
de4py
de4py тЪая╕П de4py ┘З┘И ╪и╪▒┘Ж╪з┘Е╪м ┘Е╪м╪з┘Ж┘К ┘И┘Е┘Б╪к┘И╪н ╪з┘Д┘Е╪╡╪п╪▒ CC BY-NC 4.0. ┘Д╪з ┘К┘П╪│┘Е╪н ╪и╪и┘К╪╣ ╪г┘К ┘Ж╪│╪о ┘Е╪п┘Б┘И╪╣╪й ┘Б┘К ╪г┘К ┘Е┘Г╪з┘Ж ╪в╪о╪▒ ╪г┘И ╪з╪│╪к╪о╪п╪з┘Е┘З╪з ╪к╪м╪з╪▒┘К┘Л╪з. ╪е╪░╪з ╪п┘Б╪╣╪к ┘Е┘В╪з╪и┘Д de4py╪М ┘Б┘В╪п ╪к┘Е ╪о╪п╪з╪╣┘Г. De4py ┘З┘И ╪г╪п╪з╪й ┘Е╪к┘В╪п┘Е╪й ┘Д╪е╪▓╪з┘Д╪й ╪к╪┤┘И┘К╪┤ ┘Г┘И╪п ╪и╪з┘К╪л┘И┘Ж Python Deobfuscator ╪и┘И╪з╪м┘З╪й ┘Е╪│╪к╪о╪п┘Е ╪м┘Е┘К┘Д╪й PySide6 ┘И┘Е╪м┘Е┘И╪╣╪й ┘В┘И┘К╪й ┘Е┘Ж ╪з┘Д┘Е┘К╪▓╪з╪к ┘Д┘Е╪н┘Д┘Д┘К ╪з┘Д╪и╪▒┘Е╪м┘К╪з╪к...
oletools
python-oletools oletools рдкрд╛рдпрдерди рдЯреВрд▓реНрд╕ рдХрд╛ рдПрдХ рдкреИрдХреЗрдЬ рд╣реИ рдЬреЛ Microsoft OLE2 рдлрд╝рд╛рдЗрд▓реЛрдВ рдЬрд┐рд╕реЗ рд╕реНрдЯреНрд░рдХреНрдЪрд░реНрдб рд╕реНрдЯреЛрд░реЗрдЬ, рдХрдВрдкрд╛рдЙрдВрдб рдлрд╝рд╛рдЗрд▓ рдмрд╛рдЗрдирд░реА рдлрд╝реЙрд░реНрдореЗрдЯ рдпрд╛ рдХрдВрдкрд╛рдЙрдВрдб рдбреЙрдХреНрдпреВрдореЗрдВрдЯ рдлрд╝рд╛рдЗрд▓ рдлрд╝реЙрд░реНрдореЗрдЯ рднреА рдХрд╣рд╛ рдЬрд╛рддрд╛ рд╣реИ рдХрд╛ рд╡рд┐рд╢реНрд▓реЗрд╖рдг рдХрд░рдиреЗ рдХреЗ рд▓рд┐рдП рд╣реИ, рдЬреИрд╕реЗ рдХрд┐ Microsoft Office 97-2003 рджрд╕реНрддрд╛рд╡реЗрдЬрд╝, MSI рдлрд╝рд╛рдЗрд▓реЗрдВ рдпрд╛ Outlook рд╕рдВрджреЗрд╢, рдореБрдЦреНрдп рд░реВрдк...
oletools
python-oletools oletools is a package of python tools to analyze Microsoft OLE2 files also called Structured Storage, Compound File Binary Format or Compound Document File Format, such as Microsoft Office 97-2003 documents, MSI files or Outlook messages, mainly for malware analysis, forensics and...
retoolkit
┘Е╪м┘Е┘И╪╣╪й ╪г╪п┘И╪з╪к ╪з┘Д┘Е┘З┘Ж╪п╪│ ╪з┘Д╪╣┘Г╪│┘К ┘Е╪з╪░╪з╪Я ┘З╪░┘З ┘Е╪м┘Е┘И╪╣╪й ┘Е┘Ж ╪з┘Д╪г╪п┘И╪з╪к ╪з┘Д╪к┘К ┘В╪п ╪к╪╣╪м╪и┘Г ╪е╪░╪з ┘Г┘Ж╪к ┘Е┘З╪к┘Е┘Л╪з ╪и╪з┘Д┘З┘Ж╪п╪│╪й ╪з┘Д╪╣┘Г╪│┘К╪й ┘И/╪г┘И ╪к╪н┘Д┘К┘Д ╪з┘Д╪и╪▒┘Е╪м┘К╪з╪к ╪з┘Д╪о╪и┘К╪л╪й ╪╣┘Д┘Й ╪г┘Ж╪╕┘Е╪й Windows x86 ┘И x64. ╪и╪╣╪п ╪к╪л╪и┘К╪к ┘З╪░╪з ╪з┘Д╪и╪▒┘Ж╪з┘Е╪м╪М ╪│┘К┘Г┘И┘Ж ┘Д╪п┘К┘Г ╪╖╪▒┘К┘В╪к╪з┘Ж ┘Д┘Д┘И╪╡┘И┘Д ╪е┘Д┘Й ╪з┘Д╪г╪п┘И╪з╪к: ╪з┘Ж┘В╪▒ ┘Ж┘В╪▒┘Л╪з ┘Е╪▓╪п┘И╪м┘Л╪з ╪╣┘Д┘Й ╪г┘К┘В┘И┘Ж╪й retoolkit ╪╣┘Д┘Й ╪│╪╖╪н ╪з┘Д┘Е┘Г╪к╪и. ╪з┘Ж┘В╪▒ ╪и╪▓╪▒ ╪з┘Д┘Е╪з┘И╪│...
Process-Dump
Process Dump Process Dump is a Windows reverse-engineering command-line tool to dump malware memory components back to disk for analysis. Often malware files are packed and obfuscated before they are executed in order to avoid AV scanners, however when these files are executed they will often...
azazel
Azazel A lightweight eBPF-based runtime security tracer purpose-built for malware analysis sandboxes. Drop a sample into an isolated container, and Azazel captures every syscall, file touch, network connection, and suspicious behavior, then hands you a clean JSON stream of everything that happene...
yaralyzer
THE YARALYZER Visually inspect all of the regex matches and their sexier, more cloak and dagger cousins, the YARA matches found in binary data and/or text. See what happens when you force various character encodings upon those matched bytes. With colors. Quick Start root@kitploit: pipx install...
Qu1cksc0pe
Qu1cksc0pe All-in-One malware analysis tool for analyze many file types, from Windows binaries to E-Mail files. You can get : What DLL files are used. Functions and APIs. Sections and segments. URLs, IP addresses and emails. Android permissions Dangerous/Special/Info. MITRE ATT&CK mappings Window...
hedgehog-tools
hedgehog-tools Repo of smaller scripts for malware analysis, deobfuscation and configuration extraction. See README.md files within the folders for more details. Overview of generic tools...
awesome-soc-analyst
awesome-soc-analyst рд╣рдордиреЗ SOC рд╡рд┐рд╢реНрд▓реЗрд╖рдХреЛрдВ рдФрд░ SOC рд╡рд┐рд╢реНрд▓реЗрд╖рдХ рдЙрдореНрдореАрджрд╡рд╛рд░реЛрдВ рдХреЗ рд▓рд┐рдП рдЙрдкрдпреЛрдЧреА рд╕рдВрд╕рд╛рдзрди рдПрдХрддреНрд░ рдХрд┐рдП рд╣реИрдВред рдпрд╣ рд░рд┐рдкреЙрдЬрд┐рдЯрд░реА LetsDefend рджреНрд╡рд╛рд░рд╛ рдмрдирд╛рдП рд░рдЦрд╛ рдЬрд╛рддрд╛ рд╣реИред рдпрд╣рд╛рдВ рдирдП рд╕рдВрд╕рд╛рдзрди рдЬреЛрдбрд╝рдиреЗ рдХреЗ рд▓рд┐рдП рд╕реНрд╡рддрдВрддреНрд░ рдорд╣рд╕реВрд╕ рдХрд░реЗрдВред рд╡рд┐рд╖рдп-рд╕реВрдЪреА рдкреБрд╕реНрддрдХреЗрдВ рдореИрд▓рд╡реЗрдпрд░ рд╡рд┐рд╢реНрд▓реЗрд╖рдг рдЕрднреНрдпрд╛рд╕ рдкреНрд░рдпреЛрдЧрд╢рд╛рд▓рд╛рдПрдБ рдлрд╝рд┐рд╢рд┐рдВрдЧ рд╡рд┐рд╢реНрд▓реЗрд╖рдг рдЬрд╛рдВрдЪ рдХреЗ рдЙрдкрдХрд░рдг рдиреЗрдЯрд╡рд░реНрдХ...
UnConfuserEx
UnConfuserEx Enhanced fork of UnconfuserEx with improved support for modern ConfuserEx2 variants, anti-tamper recovery, compressor removal, control-flow restoration, and resource reconstruction. https://github.com/user-attachments/assets/de2c7fd9-6736-4f39-83c0-3c25aa9c1f24 If u ever played with...
OSINT-SPY
OSINT-SPY Search using OSINTOpen Source Intelligence Performs OSINT scan on email/domain/ipaddress/organization using OSINT-SPY. It can be used by Data Miners, Infosec Researchers, Penetration Testers and cyber crime investigator in order to find deep information about their target. Release 2.0...
drltrace
Drltrace рд╡рд┐рдВрдбреЛрдЬ рдкрд░реАрдХреНрд╖рдг рдмрд┐рд▓реНрдб рд▓рд┐рдирдХреНрд╕ рдкрд░реАрдХреНрд╖рдг рдмрд┐рд▓реНрдб Drltrace рд╡рд┐рдВрдбреЛрдЬ рдФрд░ рд▓рд┐рдирдХреНрд╕ рдЕрдиреБрдкреНрд░рдпреЛрдЧреЛрдВ рдХреЗ рд▓рд┐рдП рдПрдХ рдЧрддрд┐рд╢реАрд▓ API рдХреЙрд▓ рдЯреНрд░реЗрд╕рд░ рд╣реИред Drltrace DynamoRIO рдЧрддрд┐рд╢реАрд▓ рдмрд╛рдЗрдирд░реА рдЗрдВрд╕реНрдЯреНрд░реБрдореЗрдВрдЯреЗрд╢рди рдлреНрд░реЗрдорд╡рд░реНрдХ рдкрд░ рдЖрдзрд╛рд░рд┐рдд рд╣реИред Drltrace рдХреЛ рдореВрд▓ рд░реВрдк рд╕реЗ Derek Bruening рджреНрд╡рд╛рд░рд╛ рдХрд╛рд░реНрдпрд╛рдиреНрд╡рд┐рдд рдХрд┐рдпрд╛ рдЧрдпрд╛ рдерд╛ рдФрд░ DynamoRIO рдФрд░ DrMemory...
drltrace
Drltrace Windows test build Linux test build Drltrace is a dynamic API calls tracer for Windows and Linux applications. Drltrace is built on top of DynamoRIO dynamic binary instrumentation framework. Drltrace was initialy implemented by Derek Bruening and distributed with DynamoRIO and DrMemory...
SSMA
SSMA SSMA ┘З┘К ╪г╪п╪з╪й ╪к╪н┘Д┘К┘Д ╪и╪▒┘Е╪м┘К╪з╪к ╪о╪и┘К╪л╪й ╪и╪│┘К╪╖╪й ┘Е┘Г╪к┘И╪и╪й ╪и┘Д╪║╪й Python 3. ╪з┘Д┘Е┘К╪▓╪з╪к: ╪к╪н┘Д┘К┘Д ╪╣┘Ж┘И╪з┘Ж ┘И╪г┘В╪│╪з┘Е ┘Е┘Д┘Б╪з╪к PE ╪╣╪п╪п ╪з┘Д╪г┘В╪│╪з┘Е╪М ╪з┘Д╪з┘Ж╪к╪▒┘И╪и┘К╪з ┘Д┘Д╪г┘В╪│╪з┘Е/┘Е┘Д┘Б PE╪М ╪г╪│┘Е╪з╪б ╪з┘Д╪г┘В╪│╪з┘Е ╪з┘Д┘Е╪┤╪и┘И┘З╪й╪М ╪з┘Д╪г╪╣┘Д╪з┘Е ╪з┘Д┘Е╪┤╪и┘И┘З╪й ┘Б┘К ╪о╪╡╪з╪ж╪╡ ┘Е┘Д┘Б PE╪М ╪е┘Д╪о. ╪к╪н┘Д┘К┘Д ┘Е┘Д┘Б╪з╪к ELF ┘Д╪к╪н┘Д┘К┘Д ╪з┘Д╪и╪▒┘Е╪м┘К╪з╪к ╪з┘Д╪о╪и┘К╪л╪й ┘Д┘Ж╪╕╪з┘Е Linux╪М ┘К╪│╪к╪о╪п┘Е ╪г╪п┘И╪з╪к ┘Е┘Б╪к┘И╪н╪й ╪з┘Д┘Е╪╡╪п╪▒ ┘Е╪к┘Ж┘И╪╣╪й ldd...
drakvuf-sandbox
DRAKVUF Sandbox !WARNING Here be dragons ЁЯРЙ. Maintaining your own sandbox is a difficult task and this project uses technology that is not user-friendly. Be prepared to brush up on your debugging skills as bugs may be reproducible only on your configuration. On the other hand, it's not purely an R...