MADLIRA

MADLIRA Malware detection using learning and information retrieval for Android Overview MADLIRA is a tool for Android malware detection. It consists in two components: TFIDF component and SVM learning component. In gerneral, it takes an input a set of malwares and benwares and then extracts the...

wafaray

Enhance your malware detection with WAF + YARA WAFARAY WAFARAY is a LAB deployment based on Debian 11.3.0 stable x64 made and cooked between two main ingredients WAF + YARA to detect malicious files e.g. webshells, virus, malware, binaries typically through web functions upload files. -blue.svg...

phpMussel

What is phpMussel? An ideal solution for shared hosting environments, where it's often not possible to utilise or install conventional anti-virus protection solutions, phpMussel is a PHP script designed to detect trojans, viruses, malware and other threats within files uploaded to your system...

FalconGate

Falcongate An advanced cybersecurity platform to stop Malware, Ransomware, detect cyber attacks and more... Motivation Cyber attacks are on the raise and the cyber criminals are continuously improving their tactics and developing new tools and Malware to achieve their goals of breaching their...

AndroPyTool

AndroPyTool Update! DroidBox images were fixed. Dynamic analysis is working now. This is a tool for extracting static and dynamic features from Android APKs. It combines different well-known Android apps analysis tools such as DroidBox, FlowDroid, Strace, AndroGuard or VirusTotal analysis. Provid...

Judge-Jury-and-Executable

Judge Jury and Executable A Threat Hunting Forensics Tool Features: Scan a mounted filesystem for threats right away Or gather a system baseline before an incident, for extra threat hunting ability Can be used before, during or after an incident For one to many workstations Scans the MFT, bypassi...

antispy

AntiSpy English | 简体中文 A powerful anti rootkit toolkit AntiSpy is a free but powerful anti virus and rootkits toolkit. It offers you the ability with the highest privileges that can detect,analyze and restore various kernel modifications and hooks. With its assistance,you can easily spot and...

ATMMalScan

Introduction ATMMalScan is a commandline tool for Windows operating systems version 7 and higher, which helps to search for malware traces on an ATM during the DFIR process. This tool examines the running processes of a system, as well as the hard disk, depending on the specified file path. To sc...

DeepTraffic

Deep Learning models for network traffic classification For more information please read our papers. 🎓Wei Wang's Google Scholar Homepage Wei Wang, Xuewen Zeng, Xiaozhou Ye, Yiqiang Sheng and Ming Zhu,"Malware Traffic Classification Using Convolutional Neural Networks for Representation Learning,"...

browser-xpi-malware-scanner

XPI Analyzer — Firefox Extension Security Scanner A command-line tool that analyzes Firefox extension files .xpi for signs of malware, obfuscation, hidden payloads, steganography, and other techniques used to sneak malicious code past extension review teams. What It Does extension-scanner.py tear...

memhunter

Memhunter Automated hunting of memory resident malware at scale This project is WORK IN PROGRESS. Expect feature changes and binary releases on the upcoming weeks. Overview Memhunter is an endpoint sensor tool that is specialized in detecing resident malware, improving the threat hunter analysis...

hollows_hunter

hollowshunter Hollows Hunter is a command-line application based on PE-sieve passive memory scanner. Recognizes and dumps a variety of potentially malicious implants replaced/implanted PEs, shellcodes, hooks, in-memory patches. While in case of PE-sieve you can select the process only by its PID,...

magika

Magika Magika is a novel AI-powered file type detection tool that relies on the recent advance of deep learning to provide accurate detection. Under the hood, Magika employs a custom, highly optimized model that only weighs about a few MBs, and enables precise file identification within...

DaysOfYARA-2023

100 Days of YARA Part 2 - Electric Detectaloo Apologies in advance for the terrible naming, but welcome to 100 Days of YARA! This repository will act as the store for all YARA ideas created during this time. Any fun scripts, tools, or rules you write can be committed to this GitHub repository! Fo...

Yara-Rules

Yara Rules for: Aurora Stealer Bandit Stealer Ducktail Meduza Stealer MetaStealer Nitrogen PSWSTEALER RaccoonStealerv2 SolarMarker Vidar Stealer WhiteSnake Stealer SwaetRAT DanaBot FakeBat Ande Loader WorkersDevBackdoor Pure Logs Stealer PikaBot JinxLoader GaryStealer Illyrian Stealer PureCrypter...

clamav

ClamAV ClamAV® is an open source antivirus engine for detecting trojans, viruses, malware & other malicious threats. Documentation & FAQ ClamAV documentation is hosted at docs.clamav.net. The source archive for each release also includes a copy of the documentation for offline reading. You can...

systeminformer

System Informer A free, powerful, multi-purpose tool that helps you monitor system resources, debug software and detect malware. Brought to you by Winsider Seminars & Solutions, Inc...

YaraRules

YaraRules I share YARA rules in this repo...

AMDH

AMDH Android Mobile Device Hardening written with python3. Android version, PObY-A Privacy Owned by You - Android, with malware and settings scans is available on the Play Store and the source code can be found HERE Motivations AMDH was created to help automate scanning installed applications on...

DrSemu

Dr.Semu Dr.Semu runs executables in an isolated environment, monitors the behavior of a process, and based on Dr.Semu rules created by you or the community, detects if the process is malicious or not. The tool is in the early development stage whoami: @qazqaz With Dr.Semu you can create rules to...