
malware-research
Code written as part of our various malware investigations

Code written as part of our various malware investigations

Know what changed inside your Electron release: diff two builds for IPC, preload, windows, fuses and hosts, with file:line. CLI, CI gate, MCP server.

Analysis and cleanup guide for BadBox malware on Allwinner H713 Android projectors: ADB access, infection proof, firmware backup, dropper removal,…

A modular OSINT & SOCMINT framework for social media intelligence, investigation, and public data analysis.

Zero-Trust Cellular Defense Sub-Service for Android (IMSI-Catcher, 2G SMS Blaster, and 4G aLTEr Detection & Safe Routing)

Sorry ransomware (.sorry) IOCs, YARA rules and forensic analysis - CVE-2026-41940 cPanel campaign

Forensic collection and analysis toolkit for Android and iOS devices to identify potential compromise by known spyware using public and private…

Parses iOS and iPadOS forensic extractions into HTML, TSV, timeline, KML, and LAVA reports with modular artifact discovery and encrypted iTunes…

Abuses macOS debugger entitlements and DYLD_INSERT_LIBRARIES to dump or search a running process's memory while shifting EDR attribution to a signed…

Framework for hashing declared permissions in Chromium extensions and APKs, enabling clustering, hunting, and pivoting across potentially malicious…

ELEGANTBOUNCER is a detection tool for file-based mobile exploits.

Read-only N-able N-central CVE-2026-18556/CVE-2026-18577 post-exploitation IoC hunter for Windows endpoints

Manage WhatsApp .crypt12, .crypt14 and .crypt15 files.

Tool for recovering and decrypting ES File Explorer encrypted files (.eslock)


android location service cache dumper

Linux Distro for Mobile Security, Malware Analysis, and Forensics

Extract a concerning amount of user information from Unisoc ZTE devices using CVE-2022-38694.