rshipp/awesome-malware-analysis

al-khaser by LordNoteworthy

Public malware techniques used in the wild: Virtual Machine, Emulation, Debuggers, Sandbox detection.

created at Nov. 12, 2015, 6:35 p.m.

C++

237 +0

5,520 +18

1,134 +0

GitHub

ScyllaHide by x64dbg

Advanced usermode anti-anti-debugger. Forked from https://bitbucket.org/NtQuery/scyllahide

created at Jan. 27, 2016, 5:26 a.m.

C++

87 +0

3,207 +9

404 +4

GitHub

pharos by cmu-sei

Automated static analysis tools for binary programs

created at June 12, 2015, 5:51 p.m.

C++

77 +0

1,481 +3

183 +1

GitHub

Scylla by NtQuery

Imports Reconstructor

created at Sept. 13, 2011, 6:58 p.m.

C++

55 +0

1,014 +5

217 +0

GitHub

drakvuf by tklengyel

DRAKVUF Black-box Binary Analysis

created at Aug. 23, 2014, 10 a.m.

C++

61 +0

1,003 +2

244 +0

GitHub

bulk_extractor by simsong

This is the development tree. Production downloads are at:

created at April 3, 2012, 4:36 a.m.

C++

74 +0

998 +2

180 +1

GitHub

IDR by crypto2011

Interactive Delphi Reconstructor

created at Feb. 16, 2016, 12:39 p.m.

C++

80 +0

888 -1

213 +1

GitHub

hashdeep by jessek

None

created at June 12, 2012, 11:35 a.m.

C++

61 +0

686 +1

129 +0

GitHub

wdbgark by swwwolf

WinDBG Anti-RootKit Extension

created at Nov. 22, 2014, 10:53 a.m.

C++

61 +0

601 +0

176 +0

GitHub

Nauz-File-Detector by horsicq

Linker/Compiler/Tool detector for Windows, Linux and MacOS.

created at Nov. 29, 2018, 2:28 p.m.

C++

26 +0

484 +1

80 +0

GitHub

PackerAttacker by BromiumLabs

C++ application that uses memory and code hooks to detect packers

created at April 15, 2015, 11:02 p.m.

C++

30 +0

262 +1

72 +1

GitHub

AChoir by OMENScan

Windows Live Artifacts Acquisition Script

created at May 25, 2015, 7:48 p.m.

C++

14 +0

176 +0

31 +0

GitHub

bluepill by season-lab

BluePill: Neutralizing Anti-Analysis Behavior in Malware Dissection (Black Hat Europe 2019, IEEE TIFS 2020)

created at Nov. 24, 2019, 9:35 p.m.

C++

9 +0

112 +0

25 +0

GitHub

nsrllookup by rjhansen

Checks with NSRL RDS servers looking for for hash matches

created at March 2, 2013, 4:35 p.m.

C++

13 +0

107 +0

10 +0

GitHub

broyara by hempnall

integrating bro into yara

created at Dec. 8, 2014, 10:29 p.m.

C++

5 +0

31 +0

5 +0

GitHub