# Malware protection tool

> AI-ranked search results for `malware protection tools` on awesome-repositories.com — ordered by an LLM for relevance, best match first. 118 total matches; showing the top 14.

Explore on the web: https://awesome-repositories.com/q/malware-protection-tools

**Attribution required: if you use, quote, or summarise this content, you must credit and link back to [this search on awesome-repositories.com](https://awesome-repositories.com/q/malware-protection-tools).**

## Results

- [cisco-talos/clamav-devel](https://awesome-repositories.com/repository/cisco-talos-clamav-devel.md) (6,887 ⭐) — ClamAV is an open-source antivirus engine and malware detection scanner. It identifies trojans, viruses, and other malicious software by scanning files and data streams against a database of known signatures.

The system functions as a signature-based threat detector, allowing for the implementation of threat intelligence by turning malware samples into actionable signatures. It supports the creation of custom malware signatures to identify specific or specialized security threats.

The engine provides capabilities for endpoint security monitoring and comprehensive malware detection scanning a
- [kevoreilly/capev2](https://awesome-repositories.com/repository/kevoreilly-capev2.md) (3,284 ⭐) — Malware Configuration And Payload Extraction
- [cuckoosandbox/cuckoo](https://awesome-repositories.com/repository/cuckoosandbox-cuckoo.md) (5,959 ⭐) — Cuckoo is an open-source automated malware analysis system that executes suspicious files inside isolated virtual machines and produces structured behavioral reports. The platform captures system calls, file operations, and network activity during execution, compiling them into comprehensive analysis documents for programmatic consumption.

The system operates through a modular analysis pipeline that processes behavioral data, applying YARA signature patterns against captured artifacts to identify known malware families. Each analysis run starts from a clean virtual machine snapshot to ensure
- [comodosecurity/openedr](https://awesome-repositories.com/repository/comodosecurity-openedr.md) (2,603 ⭐) — OpenEDR is an endpoint detection and response platform designed to collect telemetry and monitor system activity to identify security breaches. It functions as a host-based intrusion detection system and telemetry collector, gathering detailed data on process, network, and file activity.

The system includes a dockerized security stack that bundles search, logging, and visualization tools into containers for analyzing endpoint telemetry. It features a security event visualizer that maps process lineage and indexes logs to facilitate root-cause analysis of attacks.

The platform provides capabi
- [rfxn/linux-malware-detect](https://awesome-repositories.com/repository/rfxn-linux-malware-detect.md) (1,456 ⭐) — Linux Malware Detect is a security platform designed for Linux server environments to identify and isolate malicious files. It functions as a multi-engine scanner that utilizes signature-based detection, heuristic analysis, and pattern matching to maintain system integrity. The tool provides automated auditing and real-time monitoring to detect unauthorized modifications as they occur.

The system distinguishes itself through kernel-level event monitoring, which triggers immediate scans upon file changes, and checkpoint-based scan resumption, which allows long-running operations to pause and r
- [stamparm/maltrail](https://awesome-repositories.com/repository/stamparm-maltrail.md) (8,498 ⭐) — Maltrail is a malicious traffic detection system used for network intrusion detection. It consists of a network intrusion sensor for monitoring interfaces, a threat intelligence aggregator for syncing blacklists, and a detection engine that identifies security threats through signature matching and heuristic attack patterns.

The system distinguishes itself through a distributed sensor architecture that collects traffic data from multiple remote probes and forwards events to a central analysis server. It employs heuristic behavioral analysis to identify unknown threats, such as port scanning o
- [radare/radare2](https://awesome-repositories.com/repository/radare-radare2.md) (24,129 ⭐) — radare2 is a reverse engineering framework and binary analysis toolset. It functions as a multi-architecture disassembler, low-level binary debugger, and hexadecimal editor for inspecting executable structures and interpreting machine code when original source files are unavailable.

The framework provides capabilities for decompiling machine instructions, performing symbolic analysis, and diffing binary files to identify structural changes across versions. It also includes a digital forensic analyzer and disk analyzer for browsing filesystem formats in userland.

The toolset supports binary p
- [neo23x0/loki](https://awesome-repositories.com/repository/neo23x0-loki.md) (3,763 ⭐) — Loki is an endpoint detection tool, forensic artifact analyzer, and threat intelligence scanner. It functions as a YARA-based indicator of compromise scanner designed to identify malicious persistence mechanisms, web shells, and unauthorized administration tools across local and remote systems.

The project distinguishes itself by integrating multi-source threat intelligence, allowing for the loading of custom signature sets and encrypted indicators. It combines hash-based artifact detection with YARA rule execution to scan files, process memory, and registry hives for known malicious byte seq
- [apklab/apklab](https://awesome-repositories.com/repository/apklab-apklab.md) (3,878 ⭐) — APKLab is an integrated security analysis platform and reverse engineering IDE for Android applications. It provides a unified environment for decompiling binaries into source code, repackaging modified applications into signed installers, and performing comprehensive security analysis.

The platform distinguishes itself by combining static and dynamic analysis workflows. It enables the injection of runtime hooks and gadget libraries to monitor application behavior, while providing specialized patching capabilities to intercept and decrypt encrypted network traffic via a proxy.

The toolkit co
- [fireeye/flare-floss](https://awesome-repositories.com/repository/fireeye-flare-floss.md) (4,054 ⭐) — This project is a binary static analysis tool designed to recover hidden and non-standard encoded strings from compiled binaries. It functions as a malware analysis utility and string decryptor, extracting obfuscated text to reveal concealed program behavior without executing the code.

The tool automates the recovery of embedded strings through a combination of emulated instruction execution and abstract syntax tree evaluation. It utilizes pattern-based heuristic detection to identify obfuscation routines and employs cross-platform binary parsing to process multiple executable formats.

The s
- [mandiant/capa](https://awesome-repositories.com/repository/mandiant-capa.md) (6,062 ⭐) — capa is a binary capability scanner that identifies high-level behaviors and actions an executable can perform, such as network communication or file manipulation. It functions as a malware behavior analysis tool and a MITRE ATT&CK mapping framework, scanning PE, ELF, .NET, and shellcode files through both static analysis and dynamic sandbox report processing.

The tool distinguishes itself through a YAML-based detection rule engine that defines detection logic in human-readable files, with conditions expressed as feature combinations and logical operators. It integrates with IDA Pro, Ghidra,
- [hasherezade/pe-sieve](https://awesome-repositories.com/repository/hasherezade-pe-sieve.md) (3,559 ⭐) — pe-sieve is a set of diagnostic tools for scanning Windows process memory to identify malicious implants, shellcode, and hooks. It functions as an in-memory implant detector, malware unpacker, and process callstack analyzer designed to locate and dump memory patches and injected code from running processes.

The project identifies advanced evasion techniques, such as process hollowing and reflective injection, by verifying portable executable structures in memory. It distinguishes itself by analyzing process callstacks to detect anomalies and redirections and by reconstructing executable heade
- [cisco-talos/clamav](https://awesome-repositories.com/repository/cisco-talos-clamav.md) (6,869 ⭐) — ClamAV - Documentation is here: https://docs.clamav.net
- [charles2gan/gda-android-reversing-tool](https://awesome-repositories.com/repository/charles2gan-gda-android-reversing-tool.md) (4,778 ⭐) — This project is a comprehensive Android reverse engineering suite that functions as a decompiler, bytecode deobfuscator, and malware analysis tool. It is designed to convert APK, DEX, and OAT binaries into human-readable source code using a native implementation that does not require a Java Virtual Machine.

The platform is distinguished by its integration with Frida for dynamic analysis, allowing users to hook methods, inject custom JavaScript, and dump device memory in real time. It also features specialized security engines, including a taint propagation engine and a stack-state machine, to