
DrSemu
DrSemu - Sandboxed Malware Detection and Classification Tool Based on Dynamic Behavior

DrSemu - Sandboxed Malware Detection and Classification Tool Based on Dynamic Behavior

Signature-based detection of malware features based on Windows API call sequences. It's like YARA for sandbox API traces!

RetDec is a retargetable machine-code decompiler based on LLVM.

Platform independent peCloak fork based on Capstone

VBScript & VBA source-to-source deobfuscator with partial-evaluation

Embedded GRU neural network for real-time human behavior verification via mouse movement analysis, detecting automated analysis systems, sandboxes,…

Command-line and Python debugger for instrumenting and modifying native software behavior on Windows and Linux.

An x86-64 code virtualizer for VM based obfuscation

A Virtual Machine For Assessing Android applications, Reverse Engineering and Malware Analysis

Windows kernel driver experiment based on KasperskyHook that uses direct syscalls for interprocess memory copying, with support for unloading the…

frida-stalker based system call tracer on windows(x64).

PoC memory injection detection agent based on ETW, for offensive and defensive research purposes

Lockbit3.0 Microsoft Defender MpClient.dll DLL Hijacking PoC

A python script developed to process Windows memory images based on triage type.

frida-stalker based system call tracer on windows(x64).

Generates malicious DOCX documents exploiting CVE-2021-40444 (Microsoft Office RCE) with a hosted server for DLL payload delivery, based on…

Script analysis tool based on Frida.re

Malicious DOCX generator exploiting CVE-2021-40444 for remote code execution via crafted Office documents, with integrated hosting server for payload…