fucking awesome malware analysis
1.0.0
A curated list of awesome malware analysis tools and resources. Inspired by
228609 25039? awesome-python) and
31110 5080? awesome-php).
View Chinese translation: 恶意软件分析大合集.md.
Web traffic anonymizers for analysts.
Trap and collect your own samples.
1261 417? Conpot) - ICS/SCADA honeypot. 5271 903? Cowrie) - SSH honeypot, based
on Kippo. 61 12? DemoHunter) - Low interaction Distributed Honeypots. 718 184? Dionaea) - Honeypot designed to trap malware. 565 168? Glastopf) - Web application honeypot. 1230 174? Honeytrap) - Opensource system for running, monitoring and managing honeypots. 2440 631? MHN) - MHN is a centralized server for management and data collection of honeypots. MHN allows you to deploy sensors quickly and to collect data immediately, viewable from a neat web interface. 46 39? Mnemosyne) - A normalizer for
honeypot data; supports Dionaea. 998 203? Thug) - Low interaction honeyclient, for
investigating malicious websites.Malware samples collected for analysis.
686 238? Javascript Mallware Collection) - Collection of almost 40.000 javascript malware samples 94 25? Ragpicker) - Plugin based malware
crawler with pre-analysis and reporting functionalities 11438 2532? theZoo) - Live malware samples for
analysts. ? ?? vduddu malware repo) - Collection of
various malware files and source code. 1427 697? Zeus Source Code) - Source for the Zeus
trojan leaked in 2011.Harvest and analyze IOCs.
122 18? AbuseHelper) - An open-source
framework for receiving and redistributing abuse feeds and threat intel. 657 171? Combine) - Tool to gather Threat
Intelligence indicators from publicly available sources. 119 25? Fileintel) - Pull intelligence per file hash. 265 51? Hostintel) - Pull intelligence per host. 513 91? iocextract) - Advanced Indicator
of Compromise (IOC) extractor, Python library and command-line tool. 201 61? ioc_writer) - Python library for
working with OpenIOC objects, from Mandiant. 104 24? MalPipe) - Malware/IOC ingestion and
processing engine, that enriches collected data. 228 60? Massive Octo Spice) -
Previously known as CIF (Collective Intelligence Framework). Aggregates IOCs
from various lists. Curated by the
CSIRT Gadgets Foundation. 5449 1416? MISP) - Malware Information Sharing
Platform curated by The MISP Project. 18 7? PyIOCe) - A Python OpenIOC editor. 80 27? threataggregator) -
Aggregates security threats from a number of sources, including some of
those listed below in other resources. ? ?? ThreatIngestor) - Build
automated threat intel pipelines sourcing from Twitter, RSS, GitHub, and
more. 66 13? ThreatTracker) - A Python
script to monitor and generate alerts based on IOCs indexed by a set of
Google Custom Search Engines. 173 43? TIQ-test) - Data visualization
and statistical analysis of Threat Intelligence feeds.Threat intelligence and IOC resources.
465 117? FireEye IOCs) - Indicators of Compromise
shared publicly by FireEye. 213 110? hpfeeds) - Honeypot feed protocol. 29 13? unofficial Python library)). 4218 1008? Yara rules) - Yara rules repository. 1769 294? YETI) - Yeti is a platform meant to organize observables, indicators of compromise, TTPs, and knowledge on threats in a single, unified repository.Antivirus and other malware identification tools
204 35? AnalyzePE) - Wrapper for a
variety of tools for reporting on Windows PE files. 1416 186? BinaryAlert) - An open source, serverless
AWS pipeline that scans and alerts on uploaded files based on a set of
YARA rules. 4973 567? capa) - Detects capabilities in executable files. 7842 738? Detect It Easy(DiE)) - A program for
determining types of files. 290 49? File Scanning Framework) -
Modular, recursive file scanning solution. 1573 192? fn2yara) - FN2Yara is a tool to generate
Yara signatures for matching functions (code) in an executable program. 1 0? Generic File Parser) - A Single Library Parser to extract meta information,static analysis and detect macros within the files. 718 132? hashdeep) - Compute digest hashes with
a variety of algorithms. 1777 195? HashCheck) - Windows shell extension
to compute hashes with a variety of algorithms. 3429 585? Loki) - Host based scanner for IOCs. 192 35? Malfunction) - Catalog and
compare malware at a function level. 1025 161? Manalyze) - Static analyzer for PE
executables. 176 40? MASTIFF) - Static analysis
framework. 618 125? MultiScanner) - Modular file
scanning/analysis framework 533 80? Nauz File Detector(NFD)) - Linker/Compiler/Tool detector for Windows, Linux and MacOS. 112 10? nsrllookup) - A tool for looking
up hashes in NIST's National Software Reference Library database. 42 9? packerid) - A cross-platform
Python alternative to PEiD. 612 139? PEframe) - PEframe is an open source tool to perform static analysis on Portable Executable malware and malicious MS Office documents. 499 95? PortEx) - Java library to analyse PE files with a special focus on malware analysis and PE malformation robustness. 1344 170? Quark-Engine) - An Obfuscation-Neglect Android Malware Scoring System 1577 282? Yara rules generator) - Generate
yara rules based on a set of malware samples. Also contains a good
strings DB to avoid false positives. 2 0? Yara Finder) - A simple tool to yara match the file against various yara rules to find the indicators of suspicion.Web-based multi-AV scanners, and malware sandboxes for automated analysis.
237 38? BoomBox) - Automatic deployment of Cuckoo
Sandbox malware lab using Packer and Vagrant. 271 100? cuckoo-modified) - Modified
version of Cuckoo Sandbox released under the GPL. Not merged upstream due to
legal concerns by the author. 22 7? cuckoo-modified-api) - A
Python API used to control a cuckoo-modified sandbox. ? ?? detux) - A sandbox developed to do
traffic analysis of Linux malwares and capturing IOCs. 1076 255? DRAKVUF) - Dynamic malware analysis
system. 734 220? HaboMalHunter) - An Automated Malware
Analysis Tool for Linux ELF Files. 390 115? Limon) - Sandbox for Analyzing Linux Malware. 369 101? Malheur) - Automatic sandboxed analysis
of malware behavior. 1658 270? malice.io) - Massively scalable malware analysis framework. 368 80? malsub) - A Python RESTful API framework for
online malware and URL analysis services. 1133 222? Noriben) - Uses Sysinternals Procmon to
collect information about malware in a sandboxed environment. 130 39? Recomposer) - A helper
script for safely uploading binaries to sandbox sites. 138 40? sandboxapi) - Python library for
building integrations with several open source and commercial malware sandboxes. 817 104? SEE) - Sandboxed Execution Environment (SEE)
is a framework for building test automation in secured Environments. 139 30? Visualize_Logs) - Open source
visualization library and command line tools for logs. (Cuckoo, Procmon, more
to come...)Inspect domains and IP addresses.
38 6? boomerang) - A tool designed
for consistent and safe capture of off network web resources. 4957 777? dnstwist) - Domain name permutation
engine for detecting typo squatting, phishing and corporate espionage. 100 24? IPinfo) - Gather information
about an IP or domain by searching online resources. 505 101? Machinae) - OSINT tool for
gathering information about URLs, IPs, or hashes. Similar to Automator. 1655 258? mailchecker) - Cross-language
temporary email detection library. 80 22? MaltegoVT) - Maltego transform
for the VirusTotal API. Allows domain/IP research, and searching for file
hashes and scan reports.Analyze malicious URLs. See also the domain analysis and documents and shellcode sections.
14757 1155? Bytecode Viewer) - Combines
multiple Java bytecode viewers and decompilers into one tool, including
APK/DEX support. ? ?? Java IDX Parser) - Parses Java
IDX cache files. 163 65? jsunpack-n) - A javascript
unpacker that emulates browser functionality. 2006 223? Krakatau) - Java decompiler,
assembler, and disassembler. 432 92? RABCDAsm) - A "Robust
ActionScript Bytecode Disassembler."Analyze malicious JS and shellcode from PDFs and Office documents. See also the browser malware section.
178 41? AnalyzePDF) - A tool for
analyzing PDFs and attempting to determine whether they are malicious. 623 86? box-js) - A tool for studying JavaScript
malware, featuring JScript/WScript support and ActiveX emulation. 53 16? malpdfobj) - Deconstruct malicious PDFs
into a JSON representation. 35 9? PDF X-Ray Lite) - A PDF analysis tool,
the backend-free version of PDF X-RAY.For extracting files from inside disk and memory images.
1133 192? bulk_extractor) - Fast file
carving tool. 193 22? EVTXtract) - Carve Windows
Event Log files from raw binary data. 624 69? hachoir3) - Hachoir is a Python library
to view and edit a binary stream field by field. 629 100? Scalpel) - Another data carving
tool. 82 48? SFlock) - Nested archive
extraction/unpacking (used in Cuckoo Sandbox).Reverse XOR and other code obfuscation methods.
7008 2691? de4dot) - .NET deobfuscator and
unpacker. 3352 456? FLOSS) - The FireEye Labs Obfuscated
String Solver uses advanced static analysis techniques to automatically
deobfuscate strings from malware binaries. 86 18? NoMoreXOR) - Guess a 256 byte
XOR key using frequency analysis. 270 72? PackerAttacker) - A generic
hidden code extractor for Windows malware. 3055 626? PyInstaller Extractor) -
A Python script to extract the contents of a PyInstaller generated Windows
executable file. The contents of the pyz file (usually pyc files) present
inside the executable are also extracted and automatically fixed so that a
Python bytecode decompiler will recognize it. ? ?? uncompyle6) - A cross-version
Python bytecode decompiler. Translates Python bytecode back into equivalent
Python source code. 670 83? un{i}packer) - Automatic and
platform-independent unpacker for Windows binaries based on emulation. ? ?? unpacker) - Automated malware
unpacker for Windows malware based on WinAppDbg. ? ?? unxor) - Guess XOR keys using
known-plaintext attacks. 133 24? VirtualDeobfuscator) -
Reverse engineering tool for virtualization wrappers. 1406 173? xortool) - Guess XOR key length, as
well as the key itself.Disassemblers, debuggers, and other static and dynamic analysis tools.
7659 1088? angr) - Platform-agnostic binary analysis
framework developed at UCSB's Seclab. ? ?? bamfdetect) - Identifies and extracts
information from bots and other malware. 2081 273? BAP) - Multiplatform and
open source (MIT) binary analysis framework developed at CMU's Cylab. 1413 168? BARF) - Multiplatform, open
source Binary Analysis and Reverse engineering Framework. 2878 453? binnavi) - Binary analysis IDE for
reverse engineering based on graph visualization. 11665 1578? Binwalk) - Firmware analysis tool. 123 22? BluePill) - Framework for executing and debugging evasive malware and protected executables. 7693 1562? Capstone) - Disassembly framework for
binary analysis and reversing, with support for many architectures and
bindings in several languages. 44 6? codebro) - Web based code browser using
clang to provide basic code analysis. ? ?? Cutter) - GUI for Radare2. 808 168? DECAF (Dynamic Executable Code Analysis Framework))
- A binary analysis platform based on QEMU. DroidScope is now an extension to DECAF. 26848 5153? dnSpy) - .NET assembly editor, decompiler
and debugger. 2258 194? Fibratus) - Tool for exploration
and tracing of the Windows kernel. 7107 742? GEF) - GDB Enhanced Features, for exploiters
and reverse engineers. 52649 5953? Ghidra) - A software reverse engineering (SRE) framework created and maintained by the National Security Agency Research Directorate. 170 19? hackers-grep) - A utility to
search for strings in PE executables including imports, exports, and debug
symbols. 981 226? IDR) - Interactive Delphi Reconstructor
is a decompiler of Delphi executable files and dynamic libraries. 85 24? mac-a-mal) - An automated framework
for mac malware hunting. 105 42? PANDA) - Platform for Architecture-Neutral
Dynamic Analysis. 5915 809? PEDA) - Python Exploit Development
Assistance for GDB, an enhanced display with added commands. 1573 192? Pharos) - The Pharos binary analysis framework
can be used to perform automated static analysis of binaries. 3049 276? plasma) - Interactive
disassembler for x86/ARM/MIPS. 386 95? Pyew) - Python tool for malware
analysis. 1657 247? PyREBox) - Python scriptable reverse
engineering sandbox by the Talos team at Cisco. ? ?? QKD) - QEMU with embedded WinDbg
server for stealth debugging. 285 42? ROPMEMU) - A framework to analyze, dissect
and decompile complex code-reuse attacks. 1128 232? Scylla Imports Reconstructor) - Find and fix
the IAT of an unpacked / dumped PE32 malware. 3526 441? ScyllaHide) - An Anti-Anti-Debug library
and plugin for OllyDbg, x64dbg, IDA Pro, and TitanEngine. 66 15? SMRT) - Sublime Malware Research Tool, a
plugin for Sublime 3 to aid with malware analyis. 688 125? StringSifter) - A machine learning tool
that automatically ranks strings based on their relevance for malware analysis. 1029 298? Udis86) - Disassembler library and tool
for x86 and x86_64. 945 187? Vivisect) - Python tool for
malware analysis. ? ?? X64dbg) - An open-source x64/x32 debugger for windows.Analyze network interactions.
33 5? BroYara) - Use Yara rules from Bro. 714 159? CapTipper) - Malicious HTTP traffic
explorer. 489 112? chopshop) - Protocol analysis and
decoding framework. 1830 364? FakeNet-NG) - Next generation
dynamic network analysis tool. 188 64? Hale) - Botnet C&C monitor. 95 35? HTTPReplay) - Library for parsing
and reading out PCAP files, including TLS streams using TLS Master Secrets
(used in Cuckoo Sandbox). 743 156? Laika BOSS) - Laika BOSS is a file-centric
malware analysis and intrusion detection system. 371 60? Malcolm) - Malcolm is a powerful, easily
deployable network traffic analysis tool suite for full packet capture artifacts
(PCAP files) and Zeek logs. 1160 216? Malcom) - Malware Communications
Analyzer. 6660 1105? Maltrail) - A malicious traffic
detection system, utilizing publicly available (black)lists containing
malicious and/or generally suspicious trails and featuring an reporting
and analysis interface. 6442 1045? Moloch) - IPv4 traffic capturing, indexing
and database system. 909 102? ngrep) - Search through network traffic
like grep. 345 61? PcapViz) - Network topology and
traffic visualizer. 58 13? Python ICAP Yara) - An
ICAP Server with yara scanner for URL or content. 78 27? Squidmagic) - squidmagic is a tool
designed to analyze a web-based network traffic to detect central command
and control (C&C) servers and malicious sites, using Squid proxy server and
Spamhaus.Tools for dissecting malware in memory images or running systems.
211 48? DAMM) - Differential Analysis of
Malware in Memory, built on Volatility. 260 42? evolve) - Web interface for the
Volatility Memory Forensics Framework. 281 57? inVtero.net) - High speed memory
analysis framework developed in .NET supports all Windows x64, includes
code integrity and write support. 52 9? Muninn) - A script to automate portions
of analysis using Volatility, and create a readable report.
226 19? Orochi) - Orochi is an open source framework for
collaborative forensic memory dump analysis. 49 9? TotalRecall) - Script based
on Volatility for automating various malware analysis tasks. 194 50? VolDiff) - Run Volatility on memory
images before and after malware execution, and report changes. 7431 1294? Volatility) - Advanced
memory forensics framework. 381 82? VolUtility) - Web Interface for
Volatility Memory Analysis framework. 621 179? WDBGARK) -
WinDBG Anti-RootKit Extension. 184 29? AChoir) - A live incident response
script for gathering Windows artifacts. 49 11? python-evt) - Python
library for parsing Windows Event Logs. ? ?? GitHub)) -
Plugin-based registry analysis tool. 158 53? Aleph) - Open Source Malware Analysis
Pipeline System. 134 43? Malwarehouse) - Store, tag, and
search malware. 376 60? Polichombr) - A malware analysis
platform designed to help analysts to reverse malwares collaboratively. 6002 1178? al-khaser) - A PoC malware
with good intentions that aimes to stress anti-malware systems. 39 12? CryptoKnight) - Automated cryptographic algorithm reverse engineering and classification framework. 306 59? DC3-MWCP) -
The Defense Cyber Crime Center's Malware Configuration Parser framework. 6727 931? FLARE VM) - A fully customizable,
Windows-based, security distribution for malware analysis. 537 198? MalSploitBase) - A database
containing exploits used by malware. 1 0? Malware Organiser) - A simple tool to organise large malicious/benign files into a organised Structure. 3464 467? Pafish) - Paranoid Fish, a demonstration
tool that employs several techniques to detect sandboxes and analysis
environments in the same way as malware families do.Essential malware analysis reading material.
1668 282? APT Notes) - A collection of papers
and notes related to Advanced Persistent Threats. 964 282? Ember) - Endgame Malware BEnchmark for Research,
a repository that makes it easy to (re)create a machine learning model that can be used
to predict a score for a PE file based on static analysis. 10591 742? File Formats posters) - Nice visualization
of commonly used file format (including PE & ELF). 165 15? Malware Persistence) - Collection
of various information focused on malware persistence: detection (techniques),
response, pitfalls and the log collection (tools). 3784 788? RPISEC Malware Analysis) - These are the
course materials used in the Malware Analysis course at at Rensselaer Polytechnic
Institute during Fall 2015. 332 73? Windows Registry specification) -
Windows registry file format specification. 8295 1455? Android Security) 6387 742? AppSec) 9945 1497? CTFs) 1233 107? Executable Packing) 4039 632? Forensics) 13362 1556? "Hacking") 8757 1267? Honeypots) 1658 438? Industrial Control System Security) 7751 1537? Incident-Response) 5229 739? Infosec) 3149 466? PCAP Tools) 22166 4493? Pentesting) 12586 1938? Security) 8246 1499? Threat Intelligence) 3608 495? YARA)Pull requests and issues with suggestions are welcome! Please read the CONTRIBUTING guidelines before submitting a PR.
This list was made possible by:
Thanks!
12101 2585? rshipp/awesome-malware-analysis)
