norimaci

Norimaci "Norimaci" is a simple and lightweight malware analysis sandbox for macOS. This tool was inspired by "Noriben". Norimaci uses the features of OpenBSM or Monitor.app to monitor macOS system activity instead of Sysinternals Process Monitor procmon. Norimaci consists of 3 Python scripts...

statiStrings

statiStrings | | | | || | / | / | | \ | | '| | ' \ / / | \ \ || | | || | | || | | | | | | | \ \ |/\,|||/ || ||| ||, |/ |/ YARA Rule Strings Statistics Calculator Shelly Raban Sh3llyR, February 2021, Version 0.1 Table of Contents 1. About The Project Built With 2. Getting Started Installation...

MalPipe

MalPipe //\ | | / / \ / | |/ // | ' \ / \ / //\ \ | | / /| | | | / / /,|/ || ./ | || MalPipe is a modular malware and indicator collection and processing framework. It is designed to pull malware, domains, URLs and IP addresses from multiple feeds, enrich the collected data and export the...

WAS

WAS WAS - Wait A Sec : Automatic USB drive malware scanning tool for the security-minded person. Author: Fabio Baroni http://www.pentest.guru/ @Fabiothebest89 How many times have you plugged in a USB drive and double clicked on a file without scanning for malware? I guess, MANY. Wait A Sec! Even ...

FalconGate

Falcongate An advanced cybersecurity platform to stop Malware, Ransomware, detect cyber attacks and more... Motivation Cyber attacks are on the raise and the cyber criminals are continuously improving their tactics and developing new tools and Malware to achieve their goals of breaching their...

lupo

For instructions on how to use Lupo, visit https://github.com/malienist/lupo/wiki/Lupo-Wiki Lupo — Malware IOC Extractor Debugging module for Malware Analysis Automation For a step by step post on how to use Lupo, with images and instructions, please see this post:...

Brovan

Brovan "Emulate like a bro" - for your emulation services. Brovan is a powerful user-mode binary emulator for inspecting and running x8664 programs in a controlled emulated environment. It supports PE, ELF, memory dumps, and even raw files with no recognized file format. It is a tool used to...

PortEx

PortEx Welcome to PortEx PortEx is a Java library for static malware analysis of Portable Executable files. Its focus is on PE malformation robustness, and anomaly detection. PortEx is written in Java and Scala, and targeted at Java applications. Features Reading header information from: MSDOS...

kaiju

CERT Kaiju Binary Analysis Framework for GHIDRA CERT Kaiju is a collection of binary analysis tools for Ghidra. This is a Ghidra/Java implementation of some features of the CERT Pharos Binary Analysis Frameworkpharos, particularly the function hashing and malware analysis tools, but is expected t...

PackMyPayload

PackMyPayload - Emerging Threat of Containerized Malware Jump to supported formats This tool takes a file or directory on input and embeds them into an output file acting as an archive/container. It can serve purpose for a Proof-of-Concept presenting emerging risk of container file formats with...

Nodejs-Tracer

nodejs-tracer Simple Node.jstracer that logs calls to core modules, can spoof certain calls to defeat anti-analysis, save files written by the application and more. Useful to analyze heavily obfuscated Node.js malware. Usage node -r .\tracer.js main.js Example trace with DISPLAYSTACK active:...

masc

masc A malware web scanner developed during CyperCamp Hackathon 2017 About homepage PyPI Features At the moment, there are some features avaiable for any type of website custom or CMS and some of them only available for specific platforms: Scan any website for malware using OWASP WebMalwareScanne...

BlobRunner

BlobRunner BlobRunner is a simple tool to quickly debug shellcode extracted during malware analysis. BlobRunner allocates memory for the target file and jumps to the base or offset of the allocated memory. This allows an analyst to quickly debug into extracted artifacts with minimal overhead and...

malware-jail

malware-jail Sandbox for semi-automatic Javascript malware analysis, deobfuscation and payload extraction. Written for Node.js malware-jail is written for Node's 'vm' sandbox. Currently implements WScript Windows Scripting Host context env/wscript.js, at least the part frequently used by malware...

canisrufus

CanisRufus A stealthy Python based Windows backdoor that uses Github as a command and control server. Requirements Python 2.x pygithub3 module PyCrypto module WMI module Enum34 module Netifaces module pypiwin32 module Features Encrypted transportation messages AES + SHA256 hashing Generate comput...

Hybrid Submit

Hybrid Analysis Batch Submission Script This Python script recursively scans a folder and submits executable, script, document, and other relevant files to Hybrid Analysis Falcon Sandbox for automated malware analysis. Features Recursively walks through directories Submits only supported file typ...

PowerShellArsenal

PowerShellArsenal is a PowerShell module used to aid a reverse engineer. The module can be used to disassemble managed and unmanaged code, perform .NET malware analysis, analyze/scrape memory, parse file formats and memory structures, obtain internal system information, etc. PowerShellArsenal is...

MalwareTracesGenerator

MalwareTracesGenerator Generate malware traces for detection tests Report Bug · Request Feature 📋 Table of content 📋 Table of content 👀 About the project ❓ Why 🚀 Getting started ⚙️ Prerequisites 📦 Installation 🥷 Quick examples 👷 Contributing 🙌 Acknowledgments 📚 Licenses 👀 About the project...

mac-monitor

🎉 Welcome to "Mac Monitor's" official new home! Mac Monitor is an advanced, stand-alone system monitoring tool tailor-made for macOS security research, malware triage, and system troubleshooting. Leveraging Apple's Endpoint Security ES and System Extension APIs, it collects and enriches system...

Pegasus-Malware-Scan

pegasus-malware-scan Description Pegasus Malware Scan is a comprehensive cybersecurity solution designed for advanced threat detection and malware analysis. Built with Python, this powerful tool employs multi-layered detection techniques to identify and neutralize a wide range of malicious...