44076 matches found
CyberThreatIntel
CyberThreatIntel Analysis of malware and Cyber Threat Intel of APT and cybercriminals groups Summary 2020-01-20 - Transparent Tribe APT 2020-01-03 - MAAS Terraloader 2019-12-28 - SideWinder same targets, same TTPs, time to counter-attack ! 2019-11-18 - APT33 continue to target US companies...
defcon_27_windbg_workshop
"Modern Debugging with WinDbg Preview" DEFCON 27 workshop This repository contains the materials for the DEFCON 27 workshop Overview Abstract It's 2019 and yet too many Windows developers and hackers alike rely on useful but rather old school tools for debugging Windows binaries OllyDbg, Immunity...
MalwareConfigLists
MalwareConfigLists Just some lists of Malware Configs...
malware_analysis
Malware Analysis...
secret_handshake
Secret Handshake - A Malware C2 Channel Using x509 Certs Over mTLS Motivation First off, why would I open source this? MITRE ATT&CK only talks about stolen or self-signed certs, and NDRs as far as I can tell pay very little attention to the content of x509 certificates outside of who is the issui...
Detection
About This repository contains detection rules and IOCs that we were able to extract and use in the context of our DFIR projects and malware analyses. Contact Follow us on Twitter: https://twitter.com/SIFalconTeam...
kavanoz
🫙 kavanoz 🫙 Kavanoz jar in turkish is a tool to statically unpack common android banker malware. Do you ever wanted to get payload from packed malware without running android emulator ? Me neither : But here is a tool anyway. 👀 Installation root@kitploit: pip install kavanoz To install from sourc...
hive
From WikiLeaks: Today, 9 November 2017, WikiLeaks publishes the source code and development logs to Hive, a major component of the CIA infrastructure to control its malware. Hive solves a critical problem for the malware operators at the CIA. Even the most sophisticated malware implant on a targe...
malvinci
malvinci This simple script will introduce a new type of malware that will turn off the firewall, start an HTTP server, forward its port through ngrok, and send the URL of the server through a Telegram bot. You will need to create a new Telegram BOT. Follow the steps the steps here to create one⚡...
malware-samples
malware-samples A collection of malware samples and relevant dissection information, most probably referenced from http://blog.inquest.net or https://twitter.com/inquest. Be sure to also check out the Deep File Inspection DFI portion of https://labs.inquest.net for an interactive searchable...
KPOT-string-decrypter
KPOT-string-decrypter IDA python scripts for decrypting KPOT stealer's strings and setting those as comments next to the var that would receive them during runtime. It works as follows: Gets the offset that's passed on eax to either decryption function there are two, which is why this repo has tw...
VISION-ProcMon
About VISION-ProcMon is a tool dedicated for malware analysis and specifically when performing behavioral analysis. VISION-ProcMon is using a combination of the rust and web technologies in order to provide a fast and better visualization of the behavior of a malware after capturing its activity...
raccoon_config
raccoonconfig Scans a list of raccoon servers from Tria.ge and extracts the config as JSON. If you like, it can also automatically send follow-up malware extracted from the Raccoon config to Tria.ge API key required Resources: Logo: https://www.deviantart.com/snatti89/art/193-365-Mugshot-58870035...
Scripts-With-Malware-Analysis
This repository does not have a README...
PoC-Malware-TTPs
PoC-Malware-TTPs Proof of Concept Code Repository for Malware TTPs...
Malware
This repository does not have a README...
2023
100 Days of YARA Part 2 - Electric Detectaloo Apologies in advance for the terrible naming, but welcome to 100 Days of YARA! This repository will act as the store for all YARA ideas created during this time. Any fun scripts, tools, or rules you write can be committed to this GitHub repository! Fo...
Configuration_extractors
Configurationextractors Vidar Stealer: The configuration extractor was tested on the following samples: 37c74886ce85682039bced4a6423e233aebd962921d9a76008d19ff75483a52c 6956fb2dd65d6627c23b680d4149983017bcb8e8b8fc1d30a5210998ca8cf801 3a7512884d5e269a6c9d74a0af38c0d4d4b95bdbe5c7cc8d8608e84a725d213...
tooling-playground
tooling-playground Una colección de pequeños scripts y herramientas para la desofuscación y el análisis de malware...
DaysOfYARA-2023
100 Días de YARA Parte 2 - Electric Detectaloo Disculpas de antemano por el terrible nombre, pero ¡bienvenido a 100 Días de YARA! Este repositorio actuará como el almacén de todas las ideas de YARA creadas durante este tiempo. Cualquier script, herramienta o regla divertida que escribas puede ser...