droidlysis

DroidLysis DroidLysis is a pre-analysis tool for Android apps : it performs repetitive and boring tasks we'd typically do at the beginning of any reverse engineering. It disassembles the Android sample, organizes output in directories, and searches for suspicious spots in the code to look at. The...

GitHunt

BHEU Demos This repository contains three demos for Black Hat Europe 2025's The Forensic Trail On GitHub: Hunting For Supply Chain Activity 1. potentialattacksdemo : A Flask web application that shows a demo of identifying and investigating an attack based off the public GH firehose. 2. ghdig : A...

fastfinder

FastFinder A lightweight incident response tool for threat hunting and forensic triage ✨ Overview FastFinder is a powerful, lightweight incident response tool designed for cybersecurity professionals conducting threat hunting, live forensics, and endpoint triage. Built for both Windows and Linux...

uac

Unix-like Artifacts Collector UAC About • Documentation • Main Features • Supported Operating Systems • Usage • Contributing • Support • License 🔎 About UAC UAC Unix-like Artifacts Collector is a powerful and extensible incident response tool designed for forensic investigators, security analysts...

miteru

This repository does not have a README...

droidlysis

DroidLysis DroidLysis 是一个 Android 应用预分析工具 ：它执行我们在逆向工程开始时通常做的重复且枯燥的任务。它对 Android 样本进行反汇编，将输出组织到目录中，并搜索代码中可疑的关注点。输出有助于逆向工程师加快分析的前几步。 DroidLysis 可用于 Android 包（apk）、Dalvik 可执行文件（dex）、Zip 文件（zip）、Rar 文件（rar）或文件目录。 安装 DroidLysis 1. 安装必要的系统包 root@kitploit: sudo apt-get install default-jre git python3...

amcache-evilhunter

AmCache-EvilHunter AmCache-EvilHunter es una herramienta de línea de comandos para procesar y analizar archivos de registro Amcache.hve de Windows, identificar evidencia de ejecución, ejecutables sospechosos e integrar consultas de VirusTotal/OpenTIP para una inteligencia de amenazas mejorada...

DGA

DGA DGA sospechoso de PassiveDNS.cn y 360+VT Sandbox. Índice NCR: Necesita confirmación e ingeniería inversa Enlace| Estado ---|--- 50| DGA benigno de TeleRU, un DGA relacionado con un APK de Android 49| El DGA de MyDoom 48| Un DGA impredecible 39| Hecho Nuevas semillas de Banjori 38| Hecho Nuevo...

peframe

======= peframe peframe is a open source tool to perform static analysis on Portable Executable malware and generic suspicious file. It can help malware researchers to detect packer, xor, digital signature, mutex, anti debug, anti virtual machine, suspicious sections and functions, macro and much...

ics-forensics-tools

ICSpector: Microsoft ICS Forensics Framework Microsoft ICS Forensics Tools framework is an open-source forensics framework that enables the analysis of Industrial PLC metadata and project files. The framework provides investigators with a convenient way to scan for PLCs and identify any suspiciou...

web_exploit_detector

Web Exploit Detector Introduction The Web Exploit Detector is a Node.js application and NPM module used to detect possible infections, malicious code and suspicious files in web hosting environments. This application is intended to be run on web servers hosting one or more websites. Running the...

web_exploit_detector

Web Exploit Detector 简介 Web Exploit Detector 是一个 Node.js 应用程序（和 NPM 模块），用于检测 Web 托管环境中的可能感染、恶意代码和可疑文件。此应用程序旨在运行在托管一个或多个网站的 Web 服务器上。运行该应用程序将生成可能被感染的文件列表，以及感染描述和相关在线资源的引用。 从 1.1.0 版本开始，该应用程序还包含用于生成和比较目录结构快照的实用程序，允许用户查看是否有文件被修改、添加或删除。 该应用程序托管在 GitHub 上，以便其他人可以从中受益，同时也允许其他人贡献自己的检测规则。 链接...

cve-2025-54313

cve-2025-54313 Checks projects for compromised packages, suspicious files, and import statements, see is Supply Chain attack How? Just execute the script in the terminal/console. Consider to install maple first. root@kitploit: npm install -g maple chmod +x cve-2025-54313.sh ./cve-2025-54313.sh...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fixed the cleanup flow for mlx5eprivinit. When mlx5eprivinit fails, the cleanup flow calls mlx5eselqcleanup, which in turn calls mlx5eselqapply. This ensures that priv-statelock is held using lockdepisheld. The statelo...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlinkqueue: acquire rcureadlock in instancedestroyrcu syzbot reported that nfreinject could be called without rcureadlock : WARNING: suspicious RCU usage 6.9.0-rc7-syzkaller-02060-g5c1672705a1a 0 Not tainted...

osint-suspicious-recruitment-case

Investigación OSINT: Caso de Reclutamiento Sospechoso Este repositorio documenta una investigación de OSINT Open Source Intelligence centrada en una actividad de reclutamiento sospechosa vinculada a múltiples plataformas, números de teléfono y servicios en línea. El objetivo de este proyecto es...

`tinymember` was removed from crates.io due to affiliation with malicious code

While tinymember did not directly contain malicious code, it was owned by the same user as arone and aronenao, which contained suspicious build scripts. This crate had 2 versions published on 2026-08-18 that had a total of 27 downloads. There were no crates depending on this crate on crates.io. T...

MAL-2026-13366 Malicious code in @workoscalif/sudoku (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6502011179b6d16c43f982d5d7bfb08feec7470444be52a5a3547cfafe0e217 package.json declares a postinstall script that spawns vendor/gridgen-linux-x64 during npm install. The README describes this file as a 34 kB static...

Malicious code in @workoscalif/sudoku (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6502011179b6d16c43f982d5d7bfb08feec7470444be52a5a3547cfafe0e217 package.json declares a postinstall script that spawns vendor/gridgen-linux-x64 during npm install. The README describes this file as a 34 kB static...

MAL-2026-12339 Malicious code in async-mutex-hook (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 624c93cbd007656467757c5504db29971b220bc36685eda2af6a1d1390715133 Package is published under the name async-mutex-hook and self-describes as a Promise-based mutex library, but ships no mutex implementation. Its...