VX-API

managed by vx-underground | follow us on Twitter | download malware samples at the VXUG/samples page VX-API Version: 2.01.015 Developer: smellyvx The VX-API is a collection of malicious functionality to aid in malware development. It is recommended you clone and/or download this entire repo then...

malwarescanner

MalwareScanner Very basic malware Scanner by hash comparison Sometimes this can be needed when an incident response. If you found new or suspicious files when you do response, you want to check out where these files exist in systems. so then you may need like this tool. this is a demo version. no...

engine

Droidefense Engine Advance Android Malware Analysis Framework Latest release Download What Droidefense is Droidefense originally named atom: a nalysis t hrough o bservation m achine is the codename for android apps/malware analysis/reversing tool. It was built focused on security issues and trick...

CVE-2017-5638_struts

I extended Scott Campbell's script further, made it more complicated : While "HTTPStrutsAttack" will stop 100% of the recon, there was still miniscule chance that if a scanner hits a vulnerable system, even though we'd block the scanner, vulnerable system might still do the wget included in the...

aura

.. image:: https://cdn.sourcecode.ai/imgs/logotype.png :target: https://aura.sourcecode.ai/ ====== .. class:: center |homepageflair| |docsflair| |dockerflair| |licenseflair| |travisflair| |pypiflair| Source code auditing and static code analysis Aura is a static analysis framework developed as a...

thematrix

TheMatrix This project was created to ease the malware analysis process. The goal is to create an activator binary whose purpose is to load a user defined binary and monitor the execution by using Win32 API hooks. Relevant data is then saved to disk. The code supports both x86 and x64 binaries. D...

malboxes

= Malboxes :toc: preamble :toclevels: 2 :twob: https://twitter.com/obilodeau :twhg: https://twitter.com/hugospns // github stuff ifdef::env-github:github: ifndef::github // local logo image::docs/logos/main.svgMalboxes Logo endif:: ifdef::github // logo on github...

CVE-2023-38831-KQL

CVE-2023-38831 - WinRAR File Extension Spoofing Vulnerability Description Cybercriminals have exploited a vulnerability allowing them to spoof file extensions. This means they can hide the launch of malicious scripts within archives pretending to be common file types such as .jpg, .txt, etc. This...

Exploit-Win32.CVE-2012-0158.F.doc

Exploit-Win32.CVE-2012-0158.F.doc the name of virus is the detection of microsoft defender, is the tipic antivirus...

pe-sieve

Introduction PE-sieve est un outil qui aide à détecter les malwares en cours d'exécution sur le système, ainsi qu'à collecter le matériel potentiellement malveillant pour une analyse plus approfondie. Il reconnaît et vide une variété d'implants dans le processus scanné : PE remplacés/injectés,...

Ponce

Ponce Ponce pronounced 'poN θe pon-they is an IDA Pro plugin that provides users the ability to perform taint analysis and symbolic execution over binaries in an easy and intuitive fashion. With Ponce you are one click away from getting all the power from cutting edge symbolic execution. Entirely...

FalconGate

Falcongate An advanced cybersecurity platform to stop Malware, Ransomware, detect cyber attacks and more... Motivation Cyber attacks are on the raise and the cyber criminals are continuously improving their tactics and developing new tools and Malware to achieve their goals of breaching their...

CVE-2018-20250-WinRAR

CVE-2018-20250-WinRAR This resource is the author's reproduction of the WinRAR vulnerability CVE-2020-0601, implemented by combining related resources and articles. It is recommended to combine the author's blog to reproduce this vulnerability and understand the principle of malware self-start...

binaryalert

BinaryAlert : Détection de malwares serverless, en temps réel & rétroactive .. image:: https://travis-ci.org/airbnb/binaryalert.svg?branch=master :target: https://travis-ci.org/airbnb/binaryalert :alt: Statut de build .. image::...

binaryalert

BinaryAlert: Serverless, Real-Time & Retroactive Malware Detection .. image:: https://travis-ci.org/airbnb/binaryalert.svg?branch=master :target: https://travis-ci.org/airbnb/binaryalert :alt: Build Status .. image:: https://coveralls.io/repos/github/airbnb/binaryalert/badge.svg?branch=master...

RATDecoders

RATDecoders Malconf is a python3 library that can be used to staticly analyse specific malware families and extract the Configuration data that can be used by Incident Responders during an incident. As a library it can also be installed in to automated malware analysis pipelines. Installation...

retoolkit

Boîte à outils du rétro-ingénieur Qu'est-ce que c'est ? Il s'agit d'une collection d'outils qui pourraient vous plaire si vous êtes intéressé par le rétro-ingénierie et/ou l'analyse de malwares sur les systèmes Windows x86 et x64. Après avoir installé ce programme, vous aurez deux façons d'accéde...

loki-parse

loki-parse A python script that can detect and parse loki-bot malware related network traffic between a compromised host and a C2 server. This script can be helpful to DFIR analysts and security researchers who want to know what data is being exfiltrated to the C2, bot tracking, etc... This scrip...

imaginaryC2

Imaginary C2 author: Felix Weyne website Twitter Imaginary C2 is a python tool which aims to help in the behavioral network analysis of malware. Imaginary C2 hosts a HTTP server which captures HTTP requests towards selectively chosen domains/IPs. Additionally, the tool aims to make it easy to...

my-little-honeypot

my-little-honeypot Description This repository aims to show how easy it is to code a telnet honeypot in order to recovering IOT malwares, and thus, active Command & Control. This code has been released espacially because of the conference I gave at the INSHACK event in Lyon, France on April 6th...