#2Tools for observing malware behavior in isolated environments to understand its actions and impact.
Kitploit recommended
gilnett/wstraceStandalone zero-driver Windows system and API monitor in Rust
projectdiscovery/collaboratorBurpSuite Standard/Private Collaborator Library
frida/cloudspyProof-of-concept web app built on top of Frida
owasp/vulnreachRuntime-aware SCA — proves which CVEs are actually reachable, not just installed.
professorquantumuniverse/vetoOpen-source Android client for VirusTotal. Scan files, URLs, and installed apps against 70+ antivirus engines. View detailed reports with hashes,…
ignacioj/whacamoleLive memory analysis detecting malware IOCs in processes, modules, handles, tokens, threads, .NET assemblies, memory address space and environment…
nirvanaon/antive-behaviorwatchEmbedded GRU neural network for real-time human behavior verification via mouse movement analysis, detecting automated analysis systems, sandboxes,…
aftermathlabs/discord-crasherSome bugs found via binary instrumentation and fuzzing
withsecurelabs/amsidetectionProof-of-concept tool for detecting AMSI (Antimalware Scan Interface) bypasses and malicious in-memory script activity on Windows endpoints.
vichhka-git/magisk-renefMagisk module that auto-packages renef_server (dynamic instrumentation for Android)
rakosn1cek/oversightA lightweight security auditor and sandbox for shell scripts. Oversight combines a Static Analysis engine (Rust) with Dynamic Enforcement (Linux…
nccgroup/binja_dynamicsA PyQt5 frontend to the binjatron plugin for Binary Ninja that includes highlighting features aimed at making it easier for beginners to learn about…
dnszlsk/muad-dibReal-time npm/PyPI supply-chain threat detection. Behavioral chain analysis, AST scanning, IOC feeds, and compound scoring engine.
tracebyte8/systraceLinux system-call monitor using ptrace to trace file, process, network, and memory activity, with namespace isolation and machine learning…
iterat0r/cnaemulatorStandalone emulation and testing harness for Cobalt Strike Aggressor Scripts (.cna) that validates syntax, mocks Beacon APIs, and executes BOFs via…
anpa1200/aidebugEvidence-focused malware reverse engineering with deep PE/.NET inspection, Ghidra reconstruction, AI cross-checks, YARA, and ELF debugging
teycir/apihunterAsync API security scanner in Rust for CORS, CSP, GraphQL, JWT, OpenAPI, and active API posture checks.
hydradragonantivirus/hydradragonav-mobileAndroid Antivirus which doesn't require root, adb, ca install and cloud with many features and ways to detect more zero-day malware
