rshipp/awesome-malware-analysis

angr by angr

A powerful and user-friendly binary analysis platform!

updated at April 27, 2024, 7:42 p.m.

Python

185 +0

7,214 +12

1,036 +4

GitHub

pafish by a0rtega

Pafish is a testing tool that uses different techniques to detect virtual machines and malware analysis environments in the same way that malware families do

updated at April 27, 2024, 4:15 p.m.

C

174 +0

3,084 +4

454 +2

GitHub

mhn by pwnlandia

Modern Honey Network

updated at April 27, 2024, 4:12 p.m.

Python

243 +0

2,408 +1

629 +1

GitHub

hachoir by vstinner

Hachoir is a Python library to view and edit a binary stream field by field

updated at April 27, 2024, 4:06 p.m.

Python

22 +0

586 -1

69 -7

GitHub

yarGen by Neo23x0

yarGen is a generator for YARA rules

updated at April 27, 2024, 2:11 p.m.

Python

92 +0

1,451 +4

272 +0

GitHub

Scylla by NtQuery

Imports Reconstructor

updated at April 27, 2024, 2:10 p.m.

C++

55 +0

1,018 +4

217 +0

GitHub

flare-floss by mandiant

FLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.

updated at April 27, 2024, 11:57 a.m.

Python

131 +0

3,017 +6

442 +1

GitHub

pharos by cmu-sei

Automated static analysis tools for binary programs

updated at April 27, 2024, 11:21 a.m.

C++

77 +0

1,483 +2

183 +0

GitHub

DC3-MWCP by Defense-Cyber-Crime-Center

DC3 Malware Configuration Parser (DC3-MWCP) is a framework for parsing configuration information from malware. The information extracted from malware includes items such as addresses, passwords, filenames, and mutex names.

updated at April 27, 2024, 8:49 a.m.

Python

43 +0

279 +0

58 +0

GitHub

Loki by Neo23x0

Loki - Simple IOC and YARA Scanner

updated at April 27, 2024, 8:49 a.m.

Python

187 +0

3,226 +7

572 +0

GitHub

PcapViz by mateuszk87

Visualize network topologies and collect graph statistics based on pcap files

updated at April 27, 2024, 8:49 a.m.

Python

27 +0

324 -2

59 +0

GitHub

arkime by arkime

Arkime is an open source, large scale, full packet capturing, indexing, and database system.

updated at April 27, 2024, 8:49 a.m.

JavaScript

349 +0

6,118 +11

1,029 -1

GitHub

Krakatau by Storyyeller

Java decompiler, assembler, and disassembler

updated at April 27, 2024, 8:27 a.m.

Rust

95 +0

1,931 +4

266 +0

GitHub

drakvuf by tklengyel

DRAKVUF Black-box Binary Analysis

updated at April 27, 2024, 3:47 a.m.

C++

61 +0

1,005 +2

244 +0

GitHub

thug by buffer

Python low-interaction honeyclient

updated at April 26, 2024, 11:46 p.m.

Python

75 +0

955 +2

204 +0

GitHub

orochi by LDO-CERT

The Volatility Collaborative GUI

updated at April 26, 2024, 10:36 p.m.

JavaScript

12 +0

190 +1

17 +0

GitHub

fsf by EmersonElectricCo

File Scanning Framework

updated at April 26, 2024, 10:29 p.m.

Python

35 +0

282 +1

49 +0

GitHub

capstone by capstone-engine

Capstone disassembly/disassembler framework for ARM, ARM64 (ARMv8), BPF, Ethereum VM, M68K, M680X, Mips, MOS65XX, PPC, RISC-V(rv32G/rv64G), SH, Sparc, SystemZ, TMS320C64X, TriCore, Webassembly, XCore and X86.

updated at April 26, 2024, 10:15 p.m.

C

304 -3

7,036 +13

1,501 +4

GitHub

peframe by guelfoweb

PEframe is a open source tool to perform static analysis on Portable Executable malware and malicious MS Office documents.

updated at April 26, 2024, 5:16 p.m.

YARA

52 +0

594 +1

150 +0

GitHub

xortool by hellman

A tool to analyze multi-byte xor cipher

updated at April 26, 2024, 1:40 p.m.

Python

47 +0

1,335 +2

170 +0

GitHub