rshipp/awesome-malware-analysis

yeti by yeti-platform

Your Everyday Threat Intelligence

created at Dec. 13, 2015, 4:54 p.m.

Python

100 +0

1,633 +7

278 -1

GitHub

malice by maliceio

VirusTotal Wanna Be - Now with 100% more Hipster

created at Dec. 20, 2015, 11:12 p.m.

Go

96 +0

1,600 +0

261 +0

GitHub

Krakatau by Storyyeller

Java decompiler, assembler, and disassembler

created at Oct. 20, 2012, 1:36 a.m.

Rust

95 +0

1,931 +4

266 +0

GitHub

pyrebox by Cisco-Talos

Python scriptable Reverse Engineering Sandbox, a Virtual Machine instrumentation and inspection framework based on QEMU

created at July 7, 2017, 3:41 p.m.

C

95 +0

1,638 +2

249 +0

GitHub

conpot by mushorg

ICS/SCADA honeypot

created at March 20, 2013, 1:04 p.m.

Python

95 +0

1,185 +4

404 +0

GitHub

yarGen by Neo23x0

yarGen is a generator for YARA rules

created at Dec. 28, 2013, 3:10 p.m.

Python

92 +0

1,451 +4

272 +0

GitHub

bap by BinaryAnalysisPlatform

Binary Analysis Platform

created at Oct. 30, 2014, 11:59 a.m.

OCaml

91 +0

1,978 +4

271 -1

GitHub

Noriben by Rurik

Noriben - Portable, Simple, Malware Analysis Sandbox

created at April 10, 2013, 8:37 p.m.

Python

90 +0

1,071 +1

221 +0

GitHub

combine by mlsecproject

Tool to gather Threat Intelligence indicators from publicly available sources

created at Feb. 21, 2014, 5:33 p.m.

Python

90 +0

648 +1

179 +0

GitHub

ScyllaHide by x64dbg

Advanced usermode anti-anti-debugger. Forked from https://bitbucket.org/NtQuery/scyllahide

created at Jan. 27, 2016, 5:26 a.m.

C++

87 +0

3,217 +10

407 +3

GitHub

udis86 by vmt

Disassembler Library for x86 and x86-64

created at March 6, 2012, 7:36 a.m.

C

85 +0

983 +0

309 +0

GitHub

IDR by crypto2011

Interactive Delphi Reconstructor

created at Feb. 16, 2016, 12:39 p.m.

C++

80 +0

892 +4

213 +0

GitHub

capa by mandiant

The FLARE team's open-source tool to identify capabilities in executable files.

created at June 16, 2020, 9:24 p.m.

Python

78 +0

3,855 +13

491 -1

GitHub

pharos by cmu-sei

Automated static analysis tools for binary programs

created at June 12, 2015, 5:51 p.m.

C++

77 +0

1,483 +2

183 +0

GitHub

thug by buffer

Python low-interaction honeyclient

created at Feb. 20, 2012, 11:56 a.m.

Python

75 +0

955 +2

204 +0

GitHub

bulk_extractor by simsong

This is the development tree. Production downloads are at:

created at April 3, 2012, 4:36 a.m.

C++

74 +0

1,001 +3

180 +0

GitHub

binaryalert by airbnb

BinaryAlert: Serverless, Real-time & Retroactive Malware Detection.

created at July 12, 2017, 9:27 p.m.

Python

74 +0

1,380 -1

201 +0

GitHub

HashCheck by gurnec

HashCheck Shell Extension for Windows with added SHA2, SHA3, and multithreading; originally from code.kliu.org

created at Dec. 5, 2014, 2:58 a.m.

C

72 +0

1,681 +6

193 +0

GitHub

fibratus by rabbitstack

A modern tool for Windows kernel exploration and tracing with a focus on security

created at March 25, 2016, 11:28 a.m.

Go

72 +0

2,075 +3

183 +1

GitHub

chopshop by MITRECND

Protocol Analysis/Decoder Framework

created at Sept. 18, 2012, 5:51 p.m.

Python

71 +0

487 +1

111 +0

GitHub