signature-base

Signature-Base Signature-Base — это база сигнатур YARA и IOC для наших сканеров LOKI и THOR Lite. Основное назначение Signature-Base 1. Высококачественные YARA-правила и IOC с минимальным количеством ложных срабатываний 2. Четкая структура 3. Единообразный формат правил Структура каталогов iocs —...

pharos

Pharos Static Binary Analysis Framework The Pharos static binary analysis framework is a project of the Software Engineering Institute at Carnegie Mellon University. The framework is designed to facilitate the automated analysis of binary programs. It uses the ROSE compiler infrastructure develop...

CAPEv2

CAPE : Extraction de configuration et de charge utile de malwares - Documentation CAPE est un bac à sable pour malwares. Un bac à sable est utilisé pour exécuter des fichiers malveillants dans un environnement isolé tout en instrumentant leur comportement dynamique et en collectant des artefacts...

PortexAnalyzerGUI

PortexAnalyzerGUI Interface graphique pour PortEx, une bibliothèque d'analyse de fichiers exécutables portables et de malwares Téléchargement Page des versions Fonctionnalités Informations d'en-tête provenant de : En-tête MSDOS, En-tête Rich, En-tête de fichier COFF, En-tête optionnel, Table des...

yara-rules

yara-rules 최근 악성코드 연구에서 수집한 YARA 시그니처 모음 규칙 모음 Dacls Trojan 규칙: DaclsLinux.yara 규칙: DaclsWindows.yara 참조: https://blog.netlab.360.com/dacls-the-dual-platform-rat/ APT32 KerrDown 규칙: APT32KerrDown.yara 참조: https://unit42.paloaltonetworks.com/tracking-oceanlotus-new-downloader-kerrdown/ ACBackdoor ...

CAPE - Malware Configuration And Payload Extraction

CAPE is a malware sandbox. It is derived from Cuckoo and is designed to automate the process of malware analysis with the goal of extracting payloads and configuration from malware. This allows CAPE to detect malware based on payload signatures, as well as automating many of the goals of malware...

ThreatIngestor - Extract And Aggregate Threat Intelligence

An extendable tool to extract and aggregate IOCs from threat feeds. Integrates out-of-the-box with ThreatKB and MISP, and can fit seamlessly into any existing worflow with SQS, Beanstalk, and custom plugins. Overview ThreatIngestor can be configured to watch Twitter, RSS feeds, or other sources,...

Pharos: A Static Binary Analysis Framework

PenTestIT RSS Feed All of us know what static binary analysis means. It means that the analysis of the binary is performed without actually executing it. Almost two years ago, an open source framework - Pharos, was created by the Carnegie Mellon SEI, CERT Division in collaboration with the Lawren...

Artificial Inteligent Packet Inspection Engine: AIEngine

AIEngine is a next generation interactive/programmable Python/Ruby/Java packet inspection engine with capabilities of learning without any human intervention, NIDS Network Intrusion Detection System functionality, DNS domain classification, network collector, network forensics and many others...

QuickSand.io - Tool For Scanning Streams Within Office Documents Plus Xor DB Attack

QuickSand is a compact C framework to analyze suspected malware documents to 1 identify exploits in streams of different encodings, 2 locate and extract embedded executables. By having the ability to locate embedded obfuscated executables, QuickSand could detect documents that contain zero-day or...

Noriben - Portable, Simple, Malware Analysis Sandbox

Noriben is a Python-based script that works in conjunction with Sysinternals Procmon to automatically collect, analyze, and report on runtime indicators of malware. In a nutshell, it allows you to run your malware, hit a keypress, and get a simple text report of the sample's activities. Noriben...

Noriben - Your Personal, Portable Malware Sandbox

Noriben is a Python-based script that works in conjunction with Sysinternals Procmon to automatically collect, analyze, and report on runtime indicators of malware. In a nutshell, it allows you to run your malware, hit a keypress, and get a simple text report of the sample's activities. Noriben...

[Cuckoo Sandbox v0.6] Software for Automating Analysis of Suspicious Files

Cuckoo Sandbox is an Open Source software for automating analysis of suspicious files. To do so it makes use of custom components that monitor the behavior of the malicious processes while running in an isolated environment. Cuckoo generates a handful of different raw data which include: Native...