raccoon_config

raccoonconfig Scans a list of raccoon servers from Tria.ge and extracts the config as JSON. If you like, it can also automatically send follow-up malware extracted from the Raccoon config to Tria.ge API key required Resources: Logo: https://www.deviantart.com/snatti89/art/193-365-Mugshot-58870035...

Scripts-With-Malware-Analysis

This repository does not have a README...

PoC-Malware-TTPs

PoC-Malware-TTPs Proof of Concept Code Repository for Malware TTPs...

Malware

This repository does not have a README...

2023

100 Days of YARA Part 2 - Electric Detectaloo Apologies in advance for the terrible naming, but welcome to 100 Days of YARA! This repository will act as the store for all YARA ideas created during this time. Any fun scripts, tools, or rules you write can be committed to this GitHub repository! Fo...

tooling-playground

tooling-playground A collection of small scripts and tools for deobfuscation and malware analysis...

DaysOfYARA-2023

100 Days of YARA Part 2 - Electric Detectaloo Apologies in advance for the terrible naming, but welcome to 100 Days of YARA! This repository will act as the store for all YARA ideas created during this time. Any fun scripts, tools, or rules you write can be committed to this GitHub repository! Fo...

Shinigami

Shinigami Shinigami is an experimental tool designed to detect and unpack malware implants that are injected via process hollowing or generic packer routines. How this works The tool operates by hooking NT functions related to Process Hollowing and marking newly executable memory pages with the...

yara-ttd

yara-ttd - The ultimate packer nemesis Use YARA rules on Time Travel Debugging traces 1. Demo 2. Motivations 3. Install 4. Usage 5. Upcoming features Demo A binary packed with UPX A simple binary that launches calc.exe, packed with UPX. yara-ttd finds the calc.exe string in the module memory,...

Malicious code in @beloved-lenora/opencode-btw (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d95b5328fe2ba73358ca014724b677f69e5b9f8dda1429c105fde5c823dc2fc1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @beloved-lenora/opencode-shell-guard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff8dd8daa41992a2f1dec185b6924f6cc81b7172b55cccd6930f062317984ba8 The package presents itself as a safety guard that reviews shell commands before execution, but contains an undocumented branch that activates when t...

Malicious code in @beloved-lenora/opencode-todo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3b77fc053f72d1eaff51ad3b9af235119b5aa1dbb28d216c084e7023d4e963f6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @beloved-lenora/opencode-stats (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 84f3316cd114c1dae8ec5b0470fc9f16297c74c495b645085103a553002e825e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @beloved-lenora/opencode-shared-rpc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 884dad30e4b92d47985e1d8e7db8580665e8a5cd392023ea672243b62685b157 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @beloved-lenora/opencode-orchestrator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb9b82fbe28422745ef37e0239d9a11d86705c6a93808e1e90303e31622db2fe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @beloved-lenora/opencode-goal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 39f1eed75bb488db0e57e37f9f513e30a616eb00464b41c33bdea3342b9969b6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

zoshrinkC2

MeliziaC2 DNS over HTTPS targeted malware only runs once ! Some functions are not available yet ! ! WIP, don't use in production ! Key Features Auto-delete malware on failure Fully encrypted per victim RSA key DoH DNS-over-HTTPS communication Malware only runs once! Diagram Images Requires...

Config-Extractors

Malwares Decryptors...

AgentTesla-Config-Extractor

AgentTesla-Config-Extractor Config extractor for AgentTesla - Discord/Telegram Variant Usage agenttesla-config-extractor.py -f Example Output Example Hashes 0de25252f312735c0a26f7ac7a27cc8a51bfcdd900fc2e8d0a8b65013988e7e9 118a34bf096f5b9ea16c31de288793192ed4bc413ee8f50198eb7df7f5cf8f0e...

scavenger_scanner

CVE-2025-54313 IOC Scanner Cross-platform scanners for detecting Indicators of Compromise IOCs related to the eslint-config-prettier supply chain attack CVE-2025-54313. On July 18, 2025, several popular npm packages were compromised through a phishing attack. The attacker gained access to the...