polllogamer/sha-256-backdoor-discovery-engineDetects potential backdoors in SHA-256 hashes using cryptographic analysis and pattern recognition. Designed for malware analysis and security…
lcbower33/stegoscanAutomated steganography detection tool that scans websites, web servers, and local directories using AI-driven object/text recognition and deep file…
mandiant/capaRule-based static and dynamic analysis tool that identifies capabilities in PE, ELF, .NET, and shellcode files, mapping them to MITRE ATT&CK…
mandiant/speakeasyWindows malware emulation framework that executes binaries, drivers, and shellcode in a modeled runtime, emulating APIs, process/thread behavior,…
felixweyne/imaginaryc2Imaginary C2 is a python tool which aims to help in the behavioral (network) analysis of malware. Imaginary C2 hosts a HTTP server which captures…
cert-ee/cuckoo3Open-source automated malware analysis sandbox that runs suspicious files and URLs in isolated VMs and generates detailed behavioral reports.
monnappa22/limonLimon is a sandbox developed as a research project written in python, which automatically collects, analyzes, and reports on the run time indicators…
mrexodia/dumpulatorAn easy-to-use library for emulating memory dumps. Useful for malware analysis (config extraction, unpacking) and dynamic analysis in general…
botherder/krakenCross-platform Yara scanner written in Go
cert-polska/malduck🦆 Malduck is your ducky companion in malware analysis journeys
lloydlabs/wsb-detectwsb-detect enables you to detect if you are running in Windows Sandbox ("WSB")
withsecurelabs/ticktockEnumerates Windows timer-queue timers to detect Ekko sleep obfuscation, aiding memory forensics and malware analysis in identifying evasive…
password123456/certverifyA scanner that files with compromised or untrusted code signing certificates written in python.
alipay/ios-malicious-bithunteriOS Malicious Bit Hunter is a malicious plug-in detection engine for iOS applications. It can analyze the head of the macho file of the injected…
polaris64/web_exploit_detectorThe Web Exploit Detector is a Node.js application used to detect possible infections, malicious code and suspicious files in web hosting environments
gherardofiori/maliciousbrowserextensionsThis Repository is created after my own research into malicious browser extensions, by brining the work of many others and news articles into one…
manhnho/shellsumA defense tool - detect web shells in local directories via md5sum
oxiqa/irfuzzYARA-based file scanner that monitors directories, detects malware in document archives, and outputs CSV results for SIEM integration.
