ioc_writer by mandiant

None

created at July 24, 2013, 6:33 p.m.

Python

40 +0

199 +0

60 +0

GitHub
massive-octo-spice by csirtgadgets

DEPRECATED - USE v3 (bearded-avenger)

created at Jan. 6, 2014, 1:02 p.m.

Perl

56 +0

227 +0

62 +0

GitHub
Hale by pjlantz

Botnet command & control monitor

created at June 2, 2010, 11:13 a.m.

Python

17 +0

183 +0

63 +0

GitHub
polichombr by ANSSI-FR

Collaborative malware analysis framework

created at May 31, 2016, 6:54 p.m.

Python

38 +0

372 +1

64 +0

GitHub
jsunpack-n by urule99

Automatically exported from code.google.com/p/jsunpack-n

created at April 1, 2015, 11:51 p.m.

Python

16 +0

157 +0

65 +0

GitHub
hachoir by vstinner

Hachoir is a Python library to view and edit a binary stream field by field

created at Oct. 1, 2016, 3:41 p.m.

Python

22 +0

586 -1

69 -7

GitHub
PackerAttacker by BromiumLabs

C++ application that uses memory and code hooks to detect packers

created at April 15, 2015, 11:02 p.m.

C++

30 +0

261 -1

72 +0

GitHub
unipacker by unipacker

Automatic and platform-independent unpacker for Windows binaries based on emulation

created at Feb. 7, 2019, 4:39 p.m.

Python

30 +1

606 +4

73 +1

GitHub
Nauz-File-Detector by horsicq

Linker/Compiler/Tool detector for Windows, Linux and MacOS.

created at Nov. 29, 2018, 2:28 p.m.

C++

26 +0

486 +2

80 +0

GitHub
VolUtility by kevthehermit

Web App for Volatility framework

created at March 21, 2016, 3:30 p.m.

Python

40 +0

373 +0

81 +0

GitHub
malsub by diogo-fernan

A Python RESTful API framework for online malware analysis and threat intelligence services.

created at Feb. 27, 2015, 10:43 p.m.

Python

36 +0

362 +0

83 +1

GitHub
box-js by CapacitorSet

A tool for studying JavaScript malware.

created at June 17, 2016, 4:38 p.m.

JavaScript

39 +0

590 +1

83 +0

GitHub
iocextract by InQuest

Defanged Indicator of Compromise (IOC) Extractor.

created at April 17, 2018, 5:37 p.m.

Python

28 +0

485 +0

88 +0

GitHub
RABCDAsm by CyberShadow

Robust ABC (ActionScript Bytecode) [Dis-]Assembler

created at May 5, 2010, 7:23 a.m.

D

39 +0

419 +0

91 +0

GitHub
PortEx by katjahahn

Java library to analyse Portable Executable files with a special focus on malware analysis and PE malformation robustness

created at Sept. 27, 2013, 6:34 a.m.

Java

43 +0

487 -1

95 +0

GitHub
ngrep by jpr5

ngrep is like GNU grep applied to the network layer. It's a PCAP-based tool that allows you to specify an extended regular or hexadecimal expression to match against data payloads of packets. It understands many kinds of protocols, including IPv4/6, TCP, UDP, ICMPv4/6, IGMP and Raw, across a wide variety of interface types, and understands BPF filter logic in the same fashion as more common packet sniffing tools, such as tcpdump and snoop.

created at Dec. 30, 2009, 8:14 a.m.

C

22 +0

847 +0

98 -2

GitHub
machinae by HurricaneLabs

Machinae Security Intelligence Collector

created at July 6, 2015, 3:14 p.m.

Python

38 +0

495 +0

100 +0

GitHub
malheur by rieck

A Tool for Automatic Analysis of Malware Behavior

created at May 6, 2009, 10:03 a.m.

C

56 +0

362 +0

100 +0

GitHub
scalpel by sleuthkit

Scalpel is an open source data carving tool. It is not being actively maintained.

created at June 27, 2013, 4:59 p.m.

Shell

43 +0

602 +1

100 +0

GitHub
pyew by joxeankoret

Official repository for Pyew.

created at March 12, 2015, 5:05 p.m.

Python

32 +0

379 +1

101 +0

GitHub