signature-base

Signature-Base Signature-Base — это база сигнатур YARA и IOC для наших сканеров LOKI и THOR Lite. Основное назначение Signature-Base 1. Высококачественные YARA-правила и IOC с минимальным количеством ложных срабатываний 2. Четкая структура 3. Единообразный формат правил Структура каталогов iocs —...

pharos

Pharos Static Binary Analysis Framework The Pharos static binary analysis framework is a project of the Software Engineering Institute at Carnegie Mellon University. The framework is designed to facilitate the automated analysis of binary programs. It uses the ROSE compiler infrastructure develop...

CAPEv2

CAPE: マルウェア設定とペイロード抽出 - ドキュメント CAPEはマルウェアサンドボックスです。 サンドボックスは、隔離された環境で悪意のあるファイルを実行し、その動的動作を計測し、フォレンジック証拠を収集するために使用されます。 CAPEはCuckoo v1から派生しており、Windowsプラットフォームで以下の主要機能を備えています。 APIフックに基づく動作計測 実行中に作成、変更、削除されたファイルのキャプチャ PCAP形式でのネットワークトラフィックキャプチャ 動作およびネットワークシグネチャに基づくマルウェア分類 マルウェア実行中に取得されたデスクトップのスクリーンショ...

PortexAnalyzerGUI

PortexAnalyzerGUI Графический интерфейс для PortEx, библиотеки для анализа переносимых исполняемых файлов и вредоносного ПО Загрузка Страница релизов Возможности Информация из заголовков: MSDOS Header, Rich Header, COFF File Header, Optional Header, Section Table, .NET Metadata Структуры PE: Impo...

yara-rules

yara-rules Raccolta di firme YARA da recenti ricerche sul malware Set di regole Dacls Trojan Regola: DaclsLinux.yara Regola: DaclsWindows.yara Riferimento: https://blog.netlab.360.com/dacls-the-dual-platform-rat/ APT32 KerrDown Regola: APT32KerrDown.yara Riferimento:...

CAPE - Malware Configuration And Payload Extraction

CAPE is a malware sandbox. It is derived from Cuckoo and is designed to automate the process of malware analysis with the goal of extracting payloads and configuration from malware. This allows CAPE to detect malware based on payload signatures, as well as automating many of the goals of malware...

ThreatIngestor - Extract And Aggregate Threat Intelligence

An extendable tool to extract and aggregate IOCs from threat feeds. Integrates out-of-the-box with ThreatKB and MISP, and can fit seamlessly into any existing worflow with SQS, Beanstalk, and custom plugins. Overview ThreatIngestor can be configured to watch Twitter, RSS feeds, or other sources,...

Pharos: A Static Binary Analysis Framework

PenTestIT RSS Feed All of us know what static binary analysis means. It means that the analysis of the binary is performed without actually executing it. Almost two years ago, an open source framework - Pharos, was created by the Carnegie Mellon SEI, CERT Division in collaboration with the Lawren...

Artificial Inteligent Packet Inspection Engine: AIEngine

AIEngine is a next generation interactive/programmable Python/Ruby/Java packet inspection engine with capabilities of learning without any human intervention, NIDS Network Intrusion Detection System functionality, DNS domain classification, network collector, network forensics and many others...

QuickSand.io - Tool For Scanning Streams Within Office Documents Plus Xor DB Attack

QuickSand is a compact C framework to analyze suspected malware documents to 1 identify exploits in streams of different encodings, 2 locate and extract embedded executables. By having the ability to locate embedded obfuscated executables, QuickSand could detect documents that contain zero-day or...

Noriben - Portable, Simple, Malware Analysis Sandbox

Noriben is a Python-based script that works in conjunction with Sysinternals Procmon to automatically collect, analyze, and report on runtime indicators of malware. In a nutshell, it allows you to run your malware, hit a keypress, and get a simple text report of the sample's activities. Noriben...

Noriben - Your Personal, Portable Malware Sandbox

Noriben is a Python-based script that works in conjunction with Sysinternals Procmon to automatically collect, analyze, and report on runtime indicators of malware. In a nutshell, it allows you to run your malware, hit a keypress, and get a simple text report of the sample's activities. Noriben...

[Cuckoo Sandbox v0.6] Software for Automating Analysis of Suspicious Files

Cuckoo Sandbox is an Open Source software for automating analysis of suspicious files. To do so it makes use of custom components that monitor the behavior of the malicious processes while running in an isolated environment. Cuckoo generates a handful of different raw data which include: Native...