Projects sharing features with Malware Samples

Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.

Repository containing IOCs, CSV and MISP JSON from our blogs

Malicious actors often reuse code to deploy their malware, phishing website or CNC server. As a result, similiaries can be found on URLs path by inspecting internet traffic. Moreover, deep learning models or even regular ML model do not fit for inline deployment in terms of running performance. However, regexes ( or YARA rules ) can be deployed on a proxy and work in real time on all the traffic. LUDA can take a set of malicious and benign URLs and return a list of regexes ready to be deployed inline !

APTnotes data

Collection of android malware samples

A self-hosted sandbox for red teams to test payloads against modern detection before deployment. MCP integration lets an LLM agent drive analysis end to end.

x86 emulation and shellcode detection

A Libemu Cython wrapper

A tool for studying JavaScript malware.

Ransomware leak site monitoring

DRAKVUF Sandbox - automated hypervisor-level malware analysis system

Cuckoo3 is a Python 3 open source automated malware analysis system.

Distributed malware processing framework based on Python, Redis and S3.

Malware repository component for samples & static configuration with REST API interface.

Contributed by Check Point Software Technologies LTD. Programmed by Yaraslau Harakhavik

A tool to extract structured cyber information from incident reports.

snake - a malware storage zoo

An advanced real time threat intelligence framework to identify threats and malicious web traffic on the basis of IP reputation and historical data.

Zeek-Formatted Threat Intelligence Feeds

This project is a Python command-line security tool and malware analysis framework designed for threat intelligence aggregation and incident triage. It functions as an aggregator that orchestrates queries across multiple security services and sandboxes to analyze hashes, IP addresses, and domains. The tool distinguishes itself by incorporating an intelligence layer that uses language models to provide automated risk assessments and framework mappings. It also includes specialized capabilities for extracting indicators of compromise from unstructured text, documents, and web pages, as well as

SEMA is based on angr, a symbolic execution engine used to extract API calls. Especially, we extend ANGR with strategies to create representative signatures based on System Call Dependency graph (SCDG). Those SCDGs can be exploited in machine learning modules to do classification/detection.

YARA rule metadata specification and validation utility / Spécification et validation pour les règles YARA

A Windows kernel-mode rootkit that abuses legitimate communication channels to control a machine.

This dataset was made from a set of 482 not packed cleanware including executable and object files coming from /usr/bin from a fresh installation of Ubuntu 20.04. From this folder of not packed binaries, we built the 6 subsets with the packers integrated in the Packing Box with the dataset make…

Few use-cases of IDA Python (work in progress).