AmCache-EvilHunter

AmCache-EvilHunter is a command-line tool to parse and analyze Windows Amcache.hve registry hives, identify evidence of execution, suspicious executables, and integrate VirusTotal/OpenTIP lookups for enhanced threat intelligence.

https://github.com/user-attachments/assets/e23fb99b-48ad-4260-b372-2f15e5320c74

Features

• Parse offline Amcache.hve registry hives.
• Filter records by date range (--start, --end).
• Search records using keywords (--search).
• Identify known suspicious executables (--find-suspicious).
• Identify executables without a publisher (--missing-publisher).
• Kaspersky OpenTIP integration for hash lookups (--opentip, --only-detections).
• VirusTotal integration for hash lookups (--vt, --only-detections).
• Export results to JSON (--json) or CSV (--csv).

Requirements

• Python 3.7 or higher
• requests
• python-registry
• rich

Install dependencies via pip:

pip3 install -r requirements.txt

Installation

git clone https://github.com/cristianzsh/amcache-evilhunter.git
cd amcache-evilhunter
pip3 install -r requirements.txt

Usage

python3 amcache_evilhunter.py -i path/to/Amcache.hve [OPTIONS]

Options

Examples

• Parse and display all records:

  root@kitploit:~

  python3 amcache_evilhunter.py -i Amcache.hve
  

• Filter by date range and search for "notepad":

  root@kitploit:~

  python3 amcache_evilhunter.py -i Amcache.hve --start 2021-01-01 --end 2021-12-31 --search notepad
  

• Identify suspicious executables and query VirusTotal:

  root@kitploit:~

  python3 amcache_evilhunter.py -i Amcache.hve --find-suspicious -v
  

• Export VirusTotal detections to JSON:

  root@kitploit:~

  export VT_API_KEY=YOUR_API_KEY
  python3 amcache_evilhunter.py -i Amcache.hve -v --only-detections --json detections.json
  

Environment variables

• VT_API_KEY: Your VirusTotal API key used for file hash lookups.
• OPENTIP_API_KEY: Your OpenTIP API key used for file hash lookups.

Building executables

A build.sh script is provided to generate standalone binaries for both Linux and Windows (via Wine).

chmod +x build.sh
./build.sh

License

This project is licensed under the MIT License. See LICENSE for details.