Tools

mgeeky/msidump

MSI Dump - a tool that analyzes malicious MSI installation packages, extracts files, streams, binary data and incorporates YARA scanner.

crowdstrike/supermem

A python script developed to process Windows memory images based on triage type.

forrest-orr/artifacts-kit

Pseudo-malicious usermode memory artifact generator kit designed to easily mimic the footprints left by real malware on an infected Windows OS.

rhacknarok/hacksguard

A blazingly fast, multi-threaded TUI malware analysis tool built in Rust. Features deep PE parsing, YARA scanning, and heuristic risk scoring.

sandflysecurity/sandfly-entropyscan

Entropy scanner for Linux to detect packed or encrypted binaries related to malware. Finds malicious files and Linux processes and gives output with…

daffainfo/vol-rs

Volatility 3 ported to Rust. Same output, much faster.

dimareverse/nuitka-static-unpacker

Static-first research tool for unpacking Nuitka-compiled binaries: extracts constants, modules, recovers .pyc files, and generates analysis reports.

codeyourweb/fastfinder

Incident Response - Fast suspicious file finder

yelp/amira

AMIRA: Automated Malware Incident Response & Analysis

bohops/rogueassemblyhunter

Rogue Assembly Hunter is a utility for discovering 'interesting' .NET CLR modules in running processes.

memoryforensics1/volexp

volatility explorer (volatility 2)

michelcrypt4d4mus/yaralyzer

Visually inspect and force decode YARA and regex matches found in both binary and text data with colors. Lots of colors.

cristianzsh/amcache-evilhunter

Parse and analyze a Windows Amcache.hve registry hive, VirusTotal integration.

tstillz/webshell-analyzer

Web shell scanner and analyzer.

opensourcesec/cirtkit

Tools for the Computer Incident Response Team :computer:

memoryforensics1/vol3xp

Volatility Explorer Suit (volatility 3)

tylabs/qs_old

Command line tool for scanning streams within office documents plus xor db attack