capa by mandiant

The FLARE team's open-source tool to identify capabilities in executable files.

created at June 16, 2020, 9:24 p.m.

Python

78 +0

3,855 +13

491 -1

GitHub
orochi by LDO-CERT

The Volatility Collaborative GUI

created at May 18, 2020, 2:01 p.m.

JavaScript

12 +0

190 +1

17 +0

GitHub
malware-persistence by Karneades

Collection of malware persistence and hunting information. Be a persistent persistence hunter!

created at March 30, 2020, 1:52 p.m.

Unknown languages

8 +0

154 +1

17 +0

GitHub
pyinstxtractor by extremecoders-re

PyInstaller Extractor

created at March 25, 2020, 11:24 a.m.

Python

54 +1

2,431 +21

565 +0

GitHub
bluepill by season-lab

BluePill: Neutralizing Anti-Analysis Behavior in Malware Dissection (Black Hat Europe 2019, IEEE TIFS 2020)

created at Nov. 24, 2019, 9:35 p.m.

C++

9 +0

112 +0

25 +0

GitHub
quark-engine by quark-engine

Dig Vulnerabilities in the BlackBox

created at Oct. 22, 2019, 1:19 a.m.

Python

41 +0

1,227 +3

163 +0

GitHub
stringsifter by mandiant

A machine learning tool that ranks strings based on their relevance for malware analysis.

created at Sept. 5, 2019, 1:02 p.m.

Python

30 +0

646 +2

123 +0

GitHub
BoomBox by nbeede

Automatic deployment of Cuckoo Sandbox malware lab using Packer and Vagrant

created at July 31, 2019, 8:23 p.m.

PowerShell

8 +0

231 +0

39 +0

GitHub
Malcolm by idaholab

Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.

created at May 13, 2019, 6:35 p.m.

Python

18 +0

310 +1

49 +1

GitHub
ghidra by NationalSecurityAgency

Ghidra is a software reverse engineering (SRE) framework

created at March 1, 2019, 3:27 a.m.

Java

1,018 +1

47,712 +175

5,539 +6

GitHub
unipacker by unipacker

Automatic and platform-independent unpacker for Windows binaries based on emulation

created at Feb. 7, 2019, 4:39 p.m.

Python

30 +1

606 +4

73 +1

GitHub
Nauz-File-Detector by horsicq

Linker/Compiler/Tool detector for Windows, Linux and MacOS.

created at Nov. 29, 2018, 2:28 p.m.

C++

26 +0

486 +2

80 +0

GitHub
CryptoKnight by AbertayMachineLearningGroup

Cryptographic Dataset Generation & Modelling Framework

created at Sept. 2, 2018, 3:15 p.m.

Python

6 +0

38 +0

12 +0

GitHub
iocextract by InQuest

Defanged Indicator of Compromise (IOC) Extractor.

created at April 17, 2018, 5:37 p.m.

Python

28 +0

485 +0

88 +0

GitHub
ember by elastic

Elastic Malware Benchmark for Empowering Researchers

created at April 11, 2018, 5:48 p.m.

Jupyter Notebook

51 +0

898 +4

269 +2

GitHub
MalPipe by silascutler

Malware/IOC ingestion and processing engine

created at April 4, 2018, 10:05 p.m.

Python

11 +0

102 +0

24 +0

GitHub
mac-a-mal by phdphuc

The current repository contains all the scripts needed to build kernel-mode mac-a-mal malicious activity hooking on macOS.

created at March 12, 2018, 1:49 p.m.

C

10 +0

81 +0

24 +0

GitHub
sandboxapi by InQuest

Minimal, consistent Python API for building integrations with malware sandboxes.

created at Jan. 16, 2018, 7:54 p.m.

Python

21 +0

131 +1

39 +0

GitHub
awesome-yara by InQuest

A curated list of awesome YARA rules, tools, and people.

created at Aug. 23, 2017, 6:55 p.m.

Unknown languages

169 +0

3,253 +8

468 +0

GitHub
binaryalert by airbnb

BinaryAlert: Serverless, Real-time & Retroactive Malware Detection.

created at July 12, 2017, 9:27 p.m.

Python

74 +0

1,380 -1

201 +0

GitHub