Palsy-Virus

Palsy Virus Python virus that will make your pc paralyzed once it opened ,hides itself and adds itself to the registry startup ^^ Platform : -- Windows only :P...

MalConfScan

Concept MalConfScan is a Volatility plugin extracts configuration data of known malware. Volatility is an open-source memory forensics framework for incident response and malware analysis. This tool searches for malware in memory images and dumps configuration data. In addition, this tool has a...

ramnit_traffic_parser

ramnittrafficparser If you have traffic data between Ramnit and C2, you can dump the configs & modules Require PHP 7 tshark Usage $ php main.php pcap/URL Example $ php main.php "https://content.any.run/tasks/b1cf6c3e-f079-49b4-9798-44a7c511d194/download/pcap" + REGISTERBOT0xe2 : output/00e2.bin +...

hashdb-ida

HashDB IDA Plugin Malware string hash lookup plugin for IDA Pro. This plugin connects to the OALABS HashDB Lookup Service. Adding New Hash Algorithms The hash algorithm database is open source and new algorithms can be added on GitHub here. Pull requests are mostly automated and as long as our...

qs_old

QuickSand.io For QuickSand Version 2 written in Python with PDF analysis support, see quicksand.io. QuickSand Version 1 Lite is no longer being actively developed. QuickSand is a compact C framework to analyze suspected malware documents to 1 identify exploits in streams of different encodings, 2...

zeek-gozi-detector

Gozi Malware Detector This Zeek packages detects Gozi banking malware activity. Resources: The RAR files this package looks for were discussed in the following articles: https://unit42.paloaltonetworks.com/march-wireshark-gozi-answers/...

Daily-dose-of-malware

Daily dose of malware DDOM or Daily Dose of Malware allows you to gather malware and c&c from open source intelligence. It can display info, export results to text file or download malicious software. I want to make it as fresh as possible, that's why all malwares are dated on few days back. Cymo...

box-js

box.js A utility to analyze malicious JavaScript. Installation Simply install box-js from npm: npm install box-js --global box-js is also available: as a Cuckoo module see the integrations directory and Nwinternights/CuckooBoxjs; as a Dockerfile see integrations/README.md; as a package in distros...

flare-floss

FLOSS Scripts FLOSS supports converting its output into scripts for various tools. Please see the render scripts in this directory. Additionally, there is another plugin for IDA to allow FLOSS to automatically extract obfuscated strings and apply them to the currently loaded module in IDA...

malware-jail

malware-jail Sandbox for semi-automatic Javascript malware analysis, deobfuscation and payload extraction. Written for Node.js malware-jail is written for Node's 'vm' sandbox. Currently implements WScript Windows Scripting Host context env/wscript.js, at least the part frequently used by malware...

Malware-Bible

The Indoctrination Welcome to the Malware Bible. Brought to you by The Perkins Cybersecurity Educational Fund. This sacred text was created specifically to guide you on your journey into the realm of cybersecurity. Whether you are seeking to understand, master, or dominate this craft, these sacre...

CVE-2023-6000

CVE-2023-6000 PoC How does this detection method work? This template looks at the following path: /wp-content/plugins/popup-builder/readme.txt Based on the Stable Tag listed, if the version is prior to 4.2.3 then it is considered to be vulnerable. How do I run this script? 1. Download Nuclei from...

multiscanner

MultiScanner Introduction MultiScanner is a file analysis framework that assists the user in evaluating a set of files by automatically running a suite of tools for the user and aggregating the output. Tools can be custom built Python scripts, web APIs, software running on another machine, etc...

IOCs

//////////////// ////////////////////// // //////////////////////// // /// /////// ///// /////// /////// /////// /////// //////// //////// //////// //////// //////// //////// //////// //////// //////// //////// /////// /////// /////// /////// ///// // ////// // // /////////////////////////...

toolkit

English | Español Indetectables Toolkit Designed as a Swiss Army knife, this curated toolkit is invaluable for malware analysts, crackers, and cybersecurity experts. It is meticulously crafted to support both novice and experienced users. This toolkit complements the manuals and the numbered...

Malware in @liauto/win32-x64

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

phpMussel

What is phpMussel? An ideal solution for shared hosting environments, where it's often not possible to utilise or install conventional anti-virus protection solutions, phpMussel is a PHP script designed to detect trojans, viruses, malware and other threats within files uploaded to your system...

yeti

Yeti Platform Yeti aims to bridge the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline for DFIR teams. It was born out of frustration of having to answer the question "where have I seen this artifact before?" or "how do I search for IOCs related t...

Abused-Legitimate-Services

Abused Legitimate Services Legitimate third-party Platform-as-a-Service PaaS providers are becoming increasingly leveraged by threat actors for phishing and malware deployment. PaaS providers such as cloud instances, marketing platforms, content delivery networks CDN, and dynamic DNS servers have...

MADLIRA

MADLIRA Malware detection using learning and information retrieval for Android Overview MADLIRA is a tool for Android malware detection. It consists in two components: TFIDF component and SVM learning component. In gerneral, it takes an input a set of malwares and benwares and then extracts the...