
DAMM
Differential Analysis of Malware in Memory

Some of my publicly available Malware analysis and Reverse engineering.

Reverse engineering analysis of Dropper GCleaner, a malware that uses a resilient C2 infrastructure, kernel driver loading, PowerShell/Conhost…

Collection of radare2 scripts for malware analysis: carve binaries from memory dumps, patch PE headers, and decode hashed function imports in…

An open-source user mode debugger for Windows. Optimized for reverse engineering and malware analysis.

Hands-on DFIR challenges covering digital forensics, incident response, malware analysis, and threat hunting with CTF-style flags and real-world…

C# wrapper for ETW that serializes kernel and user-mode event data to JSON for threat hunting, malware analysis, and incident response, with Yara…

Limon is a sandbox developed as a research project written in python, which automatically collects, analyzes, and reports on the run time indicators…

Advanced framework for extracting digital artifacts from volatile memory (RAM) samples, enabling deep forensic analysis of system runtime state…

Volatility plugin for extracts configuration data of known malware

Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).

Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory…

Live hunting of code injection techniques

An advanced memory forensics framework

Volatility plugins for memory forensics, including detection of Gargoyle memory scanning evasion techniques.

Volatility 3 ported to Rust. Same output, much faster.

A Jupyter notebook to assist with the analysis of the output generated from Volatility memory extraction framework.

Analysis of VBS exploit CVE-2018-8174