stringsifter by mandiant

A machine learning tool that ranks strings based on their relevance for malware analysis.

created at Sept. 5, 2019, 1:02 p.m.

Python

30 +0

646 +2

123 +0

GitHub
Limon by monnappa22

Limon is a sandbox developed as a research project written in python, which automatically collects, analyzes, and reports on the run time indicators of Linux malware. It allows one to inspect Linux malware before execution, during execution, and after execution (post-mortem analysis) by performing static, dynamic and memory analysis using open source tools

created at Nov. 21, 2015, 8:37 a.m.

Python

36 +0

383 -1

121 +0

GitHub
iocs by mandiant

FireEye Publicly Shared Indicators of Compromise (IOCs)

created at Aug. 29, 2014, 12:47 a.m.

Unknown languages

160 +0

460 +0

116 +0

GitHub
chopshop by MITRECND

Protocol Analysis/Decoder Framework

created at Sept. 18, 2012, 5:51 p.m.

Python

71 +0

487 +1

111 +0

GitHub
hpfeeds by hpfeeds

Honeynet Project generic authenticated datafeed protocol

created at April 4, 2011, 3:19 p.m.

Python

30 +0

208 +0

110 +0

GitHub
see by WithSecureOpenSource

Sandboxed Execution Environment

created at Oct. 26, 2015, 11:13 a.m.

Python

57 +0

807 +0

104 +0

GitHub
cuckoo-modified by brad-accuvant

Modified edition of cuckoo

created at July 30, 2014, 6:10 p.m.

Python

57 +0

267 +0

103 +0

GitHub
pyew by joxeankoret

Official repository for Pyew.

created at March 12, 2015, 5:05 p.m.

Python

32 +0

379 +1

101 +0

GitHub
machinae by HurricaneLabs

Machinae Security Intelligence Collector

created at July 6, 2015, 3:14 p.m.

Python

38 +0

495 +0

100 +0

GitHub
malheur by rieck

A Tool for Automatic Analysis of Malware Behavior

created at May 6, 2009, 10:03 a.m.

C

56 +0

362 +0

100 +0

GitHub
scalpel by sleuthkit

Scalpel is an open source data carving tool. It is not being actively maintained.

created at June 27, 2013, 4:59 p.m.

Shell

43 +0

602 +1

100 +0

GitHub
ngrep by jpr5

ngrep is like GNU grep applied to the network layer. It's a PCAP-based tool that allows you to specify an extended regular or hexadecimal expression to match against data payloads of packets. It understands many kinds of protocols, including IPv4/6, TCP, UDP, ICMPv4/6, IGMP and Raw, across a wide variety of interface types, and understands BPF filter logic in the same fashion as more common packet sniffing tools, such as tcpdump and snoop.

created at Dec. 30, 2009, 8:14 a.m.

C

22 +0

847 +0

98 -2

GitHub
PortEx by katjahahn

Java library to analyse Portable Executable files with a special focus on malware analysis and PE malformation robustness

created at Sept. 27, 2013, 6:34 a.m.

Java

43 +0

487 -1

95 +0

GitHub
RABCDAsm by CyberShadow

Robust ABC (ActionScript Bytecode) [Dis-]Assembler

created at May 5, 2010, 7:23 a.m.

D

39 +0

419 +0

91 +0

GitHub
iocextract by InQuest

Defanged Indicator of Compromise (IOC) Extractor.

created at April 17, 2018, 5:37 p.m.

Python

28 +0

485 +0

88 +0

GitHub
malsub by diogo-fernan

A Python RESTful API framework for online malware analysis and threat intelligence services.

created at Feb. 27, 2015, 10:43 p.m.

Python

36 +0

362 +0

83 +1

GitHub
box-js by CapacitorSet

A tool for studying JavaScript malware.

created at June 17, 2016, 4:38 p.m.

JavaScript

39 +0

590 +1

83 +0

GitHub
VolUtility by kevthehermit

Web App for Volatility framework

created at March 21, 2016, 3:30 p.m.

Python

40 +0

373 +0

81 +0

GitHub
Nauz-File-Detector by horsicq

Linker/Compiler/Tool detector for Windows, Linux and MacOS.

created at Nov. 29, 2018, 2:28 p.m.

C++

26 +0

486 +2

80 +0

GitHub
unipacker by unipacker

Automatic and platform-independent unpacker for Windows binaries based on emulation

created at Feb. 7, 2019, 4:39 p.m.

Python

30 +1

606 +4

73 +1

GitHub