AndroPyTool

AndroPyTool Update! DroidBox images were fixed. Dynamic analysis is working now. This is a tool for extracting static and dynamic features from Android APKs. It combines different well-known Android apps analysis tools such as DroidBox, FlowDroid, Strace, AndroGuard or VirusTotal analysis. Provid...

clamav

ClamAV ClamAV® is an open source antivirus engine for detecting trojans, viruses, malware & other malicious threats. Documentation & FAQ ClamAV documentation is hosted at docs.clamav.net. The source archive for each release also includes a copy of the documentation for offline reading. You can...

Hackers Use New ROMULUS ClickFix Platform to Deliver LegionLoader and Other Malware

Cybersecurity researchers have disclosed details of a ClickFix delivery platform called ROMULUS that's being used to distribute malware such as Legion Loader. According to Forescout Research - Vedere Labs, ROMULUS is akin to a malware delivery service that employs ClickFix-style lures on bogus...

cosa-nostra

Cosa Nostra Cosa Nostra is an open source software clustering toolkit with a focus on malware analysis. It can create phylogenetic trees of binary malware samples that are structurally similar. It was initially released during SyScan360 Shanghai 2016. I basically maintain it since 2016 for my one...

drakvuf-sandbox

DRAKVUF Sandbox !WARNING Here be dragons 🐉. Maintaining your own sandbox is a difficult task and this project uses technology that is not user-friendly. Be prepared to brush up on your debugging skills as bugs may be reproducible only on your configuration. On the other hand, it's not purely an R...

dnschef

| | version 0.4 | | / | | | | | | | / | ' / |/| ' \ / \ | | | | | | \ | | | | / | ,|| | |/ || ||| | D O C U M E N T A T I O N DNSChef is a highly configurable DNS proxy for Penetration Testers and Malware Analysts. A DNS proxy aka "Fake DNS" is a tool used for application network traffic analysis...

MalwareForge---Advanced-Static-Malware-Analyzer

🛡️ MalwareForge - Advanced Static Malware Analyzer MalwareForge is a powerful static malware analysis tool that detects malicious behavior without executing the file. ✨ Features 🦠 Behavior Analysis : Process Injection, Persistence, Network, Stealer, Evasion 💉 8 Injection Techniques : Process...

magika

Magika Magika is a novel AI-powered file type detection tool that relies on the recent advance of deep learning to provide accurate detection. Under the hood, Magika employs a custom, highly optimized model that only weighs about a few MBs, and enables precise file identification within...

mac-monitor

🎉 Welcome to "Mac Monitor's" official new home! Mac Monitor is an advanced, stand-alone system monitoring tool tailor-made for macOS security research, malware triage, and system troubleshooting. Leveraging Apple's Endpoint Security ES and System Extension APIs, it collects and enriches system...

PcapXray

PcapXray A network forensics tool — visualize PCAP files or live traffic as an annotated network diagram with device identification, protocol classification, Tor detection, and malicious traffic flagging. Module Overview graph TD UIuserinterface.py\nGUI controller -- PRpcapreader\nFile + Live...

multiscanner

MultiScanner Introduction MultiScanner is a file analysis framework that assists the user in evaluating a set of files by automatically running a suite of tools for the user and aggregating the output. Tools can be custom built Python scripts, web APIs, software running on another machine, etc...

dga_predict

Predicting Domain Generation Algorithms using LSTMs This repo contains very simple code for classifying domains as DGA or benign. This code demonstrates our results in our arxiv paper here: https://arxiv.org/abs/1611.00791. One difference is the datasets. Both the paper and this repo use the Alex...

retoolkit

Reverse Engineer's Toolkit What? This is a collection of tools you may like if you are interested in reverse engineering and/or malware analysis on x86 and x64 Windows systems. After installing this program, you'll have two ways to access the tools: Double-click the retoolkit icon in the Desktop...

DrSemu

Dr.Semu Dr.Semu runs executables in an isolated environment, monitors the behavior of a process, and based on Dr.Semu rules created by you or the community, detects if the process is malicious or not. The tool is in the early development stage whoami: @qazqaz With Dr.Semu you can create rules to...

memhunter

Memhunter Automated hunting of memory resident malware at scale This project is WORK IN PROGRESS. Expect feature changes and binary releases on the upcoming weeks. Overview Memhunter is an endpoint sensor tool that is specialized in detecing resident malware, improving the threat hunter analysis...

azurelinux

Azure Linux 4 An open-source Linux distribution built and optimized forAzure, with sources derived from Fedora Linux. Azure Linux provides a secured, reliable operating system for virtual machines, containers, and bare-metal platforms. Azure Linux is built on a robust open-source foundation from...

PEpper

PEpper An open source tool to perform malware static analysis on P ortable E xecutable Installation eva@paradise:$ git clone https://github.com/blackeko/PEpper/ eva@paradise:$ cd PEpper eva@paradise:$ pip3 install -r requirements.txt eva@paradise:$ python3 pepper.py ./malwaredir Screenshot |...

Coldfire

ColdFire II Golang malware development framework Table of Contents Table of Contents Introduction Installation Types of functions included Requirements Disclaimer License Introduction ColdFire II provides various methods useful for malware and security infra development in Golang. Most functions...

hashdb

HashDB HashDB is a community-sourced library of hashing algorithms used in malware. How To Use HashDB HashDB can be used as a stand alone hashing library, but it also feeds the HashDB Lookup Service run by OALabs. This service allows analysts to reverse hashes and retrieve hashed API names and...

flare-floss

FLOSS Scripts FLOSS supports converting its output into scripts for various tools. Please see the render scripts in this directory. Additionally, there is another plugin for IDA to allow FLOSS to automatically extract obfuscated strings and apply them to the currently loaded module in IDA...