
malware-research
Code written as part of our various malware investigations

Code written as part of our various malware investigations

LD_PRELOAD shared library that hides a Linux process from tools like ps and lsof by intercepting readdir and proc filesystem calls.

The official Python 3 client library for VirusTotal

The official Go client library for VirusTotal API

A Windows userland tool to enumerate and classify ALPC ports, including PPL-protected processes.

This repository contains a list of new remediation scripts.

This repository includes code and IoCs that are the product of research done in Akamai's various security research teams.

Curated signature-rule collection for detecting and classifying malicious files via pattern matching, with CLI instructions for scanning files and…

A collection of various and sundry code snippets that leverage .NET dynamic tradecraft

This repository contains indicators of compromise (IOCs) of our various investigations.

Scans websites for SocGholish JavaScript injections, deobfuscates malicious payloads, and reports shadowing domain URLs used in malvertising…

Enumerate various traits from Windows processes as an aid to threat hunting


Cortex: a Powerful Observable Analysis and Active Response Engine

A command-line utility for Windows written in C that creates and configures persistent Event Tracing for Windows (ETW) AutoLogger sessions.

Simple Webshell Scanner

Suspicious DGA from PDNS and Sandbox.

Botnet monitoring is a crucial part in threat analysis and often neglected due to the lack of proper open source tools. Our tool will provide an open…