Projects sharing features with Ember

SafetyKatz is a combination of slightly modified version of @gentilkiwi's Mimikatz project and @subtee's .NET PE Loader.

Dataset of Probing Attacks (Port Scan) performed with nmap, unicornscan, hping3, zmap and masscan

A library to load, manipulate, dump PE files. See also: https://github.com/hasherezade/libpeconv_tpl

Aktaion: Open Source ML tool and data samples for Exploit and Phishing Research

Collection of malware persistence and hunting information. Be a persistent persistence hunter!

Java library to analyse Portable Executable files with a special focus on malware analysis and PE malformation robustness

Free Malware Training Datasets for Machine Learning

Windows registry file format specification

This project is a cybersecurity educational resource and courseware designed for malware analysis and reverse engineering. It provides a structured curriculum of lessons, labs, and guided projects focused on detecting and understanding the behavior of malicious software. The resource includes a lab guide for building isolated virtual machine environments to safely execute and study malware. It covers the setup of a specialized toolchain consisting of disassemblers and debuggers used to analyze compiled machine code. The training material covers both static analysis, which examines binary cod

Windows Events Attack Samples

Sophos-ReversingLabs 20 million sample dataset

Donut is a toolset for loading and executing payloads in memory, featuring a position-independent shellcode generator, an in-memory payload injector, and a .NET assembly loader. It is designed to convert executable files and scripts into shellcode that can be executed within the memory space of a remote process without writing files to disk. The project specializes in security evasion through memory-based patching and payload obfuscation using symmetric block ciphers and compression. It includes a remote payload stager to retrieve encrypted modules from HTTP or DNS servers during runtime, red

TheZoo is a centralized repository and management system designed for the storage, organization, and retrieval of live malicious software samples. It provides a structured environment for security researchers and educators to access, track, and analyze dangerous code for the purpose of threat intelligence and defense development. The system utilizes a command-line interface to manage the lifecycle of malware samples, including the preparation of new submissions and the querying of a centralized database. To ensure safety and authenticity, the platform stores binaries in password-protected, en