scan

Atomdrift Scan Atomdrift Scan is a modern ML-based malware scanner designed to detect 0-day attacks against the software supply-chain. It's designed to be deterministic, fast, and flexible, and embeddable in any workflow or security tool you have in mind, and can operate against files, archives,...

Yara-rules

About What is this? A repo containing some of my privately developed Yara rules. Why? To contribute to the community. Can I use these rules? Of course! That's why I created this repo. You can use them in your detection systems. For example, CAPE sandbox, MalwareBazaar, UnPac.me and VirusTotal mus...

naga

naga malware detonation..actually running in debug/verbose mode .. video-1 https://github.com/user-attachments/assets/40a30755-164e-4b7d-a1d7-b0df4ea20d1b shot-1 shot-2 shot-3 shot-4...

malware-research

malware-research General malware analysis stuff...

2024

100 Days of YARA 2024 Welcome to 100 Days of YARA! This repository will act as the store for all YARA ideas created during this time. Any fun scripts, tools, or rules you write can be committed to this GitHub repository! For now, any associated blogging, walkthroughs, or other musing can be hoste...

ssh-honeypot-research

🍯 SSH Honeypot — Research & Threat Intelligence A medium-interaction Cowrie honeypot deployed on a rented public-internet Linux VPS, designed to attract, log and analyse real-world SSH brute-force traffic. Over an 8-day capture window the sensor recorded 37,477 sessions from 1,582 unique attacker...

zeek-agenttesla-detector

AgentTesla This is a Zeek based AgentTesla malware detector. Testing PCAPs: https://app.any.run/tasks/f9421792-7d2c-47d3-90e0-07eb54ae12fa/ https://app.any.run/tasks/db9f075c-7879-4957-923a-f79fac957a2d/ https://app.any.run/tasks/a30789ce-1e1c-4f96-a097-78c34b9fb612/...

pyattck

Welcome to pyattck's Documentation . ... | \ \ \ / / / \ | | | / || |/ / | | | \ / / / ^ \ ---| |-------| |----| ,----'| ' / | / \ / / /\ \ | | | | | | | Current Version is 7.1.1 pyattck is a light-weight framework for MITRE ATT&CK Frameworks. This package extracts details from the MITRE...

EGESPLOIT

EGESPLOIT EGESPLOIT is a golang library for malware development, it has few unique functions for meterpreter integration. DOCUMENTATION CalculateChecksumx : Function calculates x digit 8 bit checksum for reverse HTTP/HTTPS meterpreter connections, returns the calculated checksum as string...

volatility

This project is archived. See Volatility 3 for modern investigations: https://github.com/volatilityfoundation/volatility3 ============================================================================ Volatility Framework - Volatile memory extraction utility framework The Volatility Framework is a...

pafish

Pafish Pafish is a testing tool that uses different techniques to detect virtual machines and malware analysis environments in the same way that malware families do. The project is free and open source; the code of all the anti-analysis techniques is publicly available. Pafish executables for...

frida-dexdump

FRIDA-DEXDump frida-dexdump is a frida tool to find and dump dex in memory to support security engineers in analyzing malware. Make Jetbrains Great Again Features 1. Support fuzzy search broken header dexdeep search mode. 2. Compatible with all android versionfrida supported. 3. One click...

DepAlert

DepAlert Agent CTWall This tool is part of the CTWall platform. See: CTWall Description DepAlert is an open-source security gate for your CI/CD pipeline. It analyzes SBOMs against malware intelligence data and quickly tells you whether your build includes known malicious packages. DepAlert solves...

Malware in xmd-baileys

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in bungoma

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @developmentyora/baileyss

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @developmentyora/yorakids

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in kiyoramarkets

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in asistenyorstore

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @celestial-community/baileys

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...