Projects sharing features with Libemu

This project is a Python command-line security tool and malware analysis framework designed for threat intelligence aggregation and incident triage. It functions as an aggregator that orchestrates queries across multiple security services and sandboxes to analyze hashes, IP addresses, and domains. The tool distinguishes itself by incorporating an intelligence layer that uses language models to provide automated risk assessments and framework mappings. It also includes specialized capabilities for extracting indicators of compromise from unstructured text, documents, and web pages, as well as

APTnotes data

Collection of android malware samples

A self-hosted sandbox for red teams to test payloads against modern detection before deployment. MCP integration lets an LLM agent drive analysis end to end.

A Libemu Cython wrapper

A tool for studying JavaScript malware.

Ransomware leak site monitoring

Cuckoo3 is a Python 3 open source automated malware analysis system.

DRAKVUF Sandbox - automated hypervisor-level malware analysis system

Distributed malware processing framework based on Python, Redis and S3.

Malware repository component for samples & static configuration with REST API interface.

Contributed by Check Point Software Technologies LTD. Programmed by Yaraslau Harakhavik

A tool to extract structured cyber information from incident reports.

snake - a malware storage zoo

An advanced real time threat intelligence framework to identify threats and malicious web traffic on the basis of IP reputation and historical data.

Zeek-Formatted Threat Intelligence Feeds

SEMA is based on angr, a symbolic execution engine used to extract API calls. Especially, we extend ANGR with strategies to create representative signatures based on System Call Dependency graph (SCDG). Those SCDGs can be exploited in machine learning modules to do classification/detection.

YARA rule metadata specification and validation utility / Spécification et validation pour les règles YARA

A Windows kernel-mode rootkit that abuses legitimate communication channels to control a machine.

droidefense (originally named atom: a nalysis t hrough o bservation m achine)* is the codename for android apps/malware analysis/reversing tool. It was built focused on security issues and tricks that malware researcher have on they every day work. For those situations on where the malware has…

Pafish is an anti-analysis sandbox detector and virtualization environment tester. It serves as a diagnostic utility to identify if a system is running inside a virtual machine or a malware analysis sandbox by executing common anti-analysis techniques. The tool validates the effectiveness of various evasion methods and supports research into sandbox detection. It tests whether a target system can be recognized as a virtualized environment to help improve the stealth of malware analysis environments. Detection is achieved through a variety of behavioral checks, including hardware artifact ana