Open-source alternatives to Zeek Intelligence Feeds

APTnotes data

Collection of android malware samples

A self-hosted sandbox for red teams to test payloads against modern detection before deployment. MCP integration lets an LLM agent drive analysis end to end.

x86 emulation and shellcode detection

A Libemu Cython wrapper

A tool for studying JavaScript malware.

DRAKVUF Sandbox - automated hypervisor-level malware analysis system

Contributed by Check Point Software Technologies LTD. Programmed by Yaraslau Harakhavik

YARA rule metadata specification and validation utility / Spécification et validation pour les règles YARA

droidefense (originally named atom: a nalysis t hrough o bservation m achine)* is the codename for android apps/malware analysis/reversing tool. It was built focused on security issues and tricks that malware researcher have on they every day work. For those situations on where the malware has…

Pafish is an anti-analysis sandbox detector and virtualization environment tester. It serves as a diagnostic utility to identify if a system is running inside a virtual machine or a malware analysis sandbox by executing common anti-analysis techniques. The tool validates the effectiveness of various evasion methods and supports research into sandbox detection. It tests whether a target system can be recognized as a virtualized environment to help improve the stealth of malware analysis environments. Detection is achieved through a variety of behavioral checks, including hardware artifact ana