Projects sharing features with Android Malware

Malicious actors often reuse code to deploy their malware, phishing website or CNC server. As a result, similiaries can be found on URLs path by inspecting internet traffic. Moreover, deep learning models or even regular ML model do not fit for inline deployment in terms of running performance. However, regexes ( or YARA rules ) can be deployed on a proxy and work in real time on all the traffic. LUDA can take a set of malicious and benign URLs and return a list of regexes ready to be deployed inline !

This project is a Python command-line security tool and malware analysis framework designed for threat intelligence aggregation and incident triage. It functions as an aggregator that orchestrates queries across multiple security services and sandboxes to analyze hashes, IP addresses, and domains. The tool distinguishes itself by incorporating an intelligence layer that uses language models to provide automated risk assessments and framework mappings. It also includes specialized capabilities for extracting indicators of compromise from unstructured text, documents, and web pages, as well as

APTnotes data

A self-hosted sandbox for red teams to test payloads against modern detection before deployment. MCP integration lets an LLM agent drive analysis end to end.

x86 emulation and shellcode detection

A Libemu Cython wrapper

A tool for studying JavaScript malware.

Ransomware leak site monitoring

Cuckoo3 is a Python 3 open source automated malware analysis system.

Few use-cases of IDA Python (work in progress).

Distributed malware processing framework based on Python, Redis and S3.

Malware repository component for samples & static configuration with REST API interface.

Contributed by Check Point Software Technologies LTD. Programmed by Yaraslau Harakhavik

A tool to extract structured cyber information from incident reports.

snake - a malware storage zoo

An advanced real time threat intelligence framework to identify threats and malicious web traffic on the basis of IP reputation and historical data.

Zeek-Formatted Threat Intelligence Feeds

SEMA is based on angr, a symbolic execution engine used to extract API calls. Especially, we extend ANGR with strategies to create representative signatures based on System Call Dependency graph (SCDG). Those SCDGs can be exploited in machine learning modules to do classification/detection.

YARA rule metadata specification and validation utility / Spécification et validation pour les règles YARA

A Windows kernel-mode rootkit that abuses legitimate communication channels to control a machine.

Scans a malware file and lists down the related MBC (Malware Behavior Catalog) details.

Pafish is an anti-analysis sandbox detector and virtualization environment tester. It serves as a diagnostic utility to identify if a system is running inside a virtual machine or a malware analysis sandbox by executing common anti-analysis techniques. The tool validates the effectiveness of various evasion methods and supports research into sandbox detection. It tests whether a target system can be recognized as a virtualized environment to help improve the stealth of malware analysis environments. Detection is achieved through a variety of behavioral checks, including hardware artifact ana