Projects sharing features with APKiD

RetDec is a reverse engineering framework and static binary analysis tool. Its primary purpose is to function as an LLVM-based machine code decompiler that translates binary machine code from multiple architectures into high-level C source code. The system employs a multi-stage lifting pipeline to recover program logic, using an intermediate representation to apply optimizations before emitting source code. It distinguishes itself through the ability to identify compilers and packers, perform executable unpacking, and reconstruct class hierarchies and original program structures. The framewo

A Yara rule generator for finding related samples and hunting

AI-assisted malware reverse-engineering debugger with ATT&CK, YARA, IOC, JSON, and analyst report output

Serverless, real-time, ClamAV+Yara scanning for your S3 Buckets

YARA malware query accelerator (web frontend)

A multi-platform .Net wrapper library for the native Yara library.

Parsing of YARA rules into AST and building new rulesets in C++.

YARI is an interactive debugger for YARA Language.

YARA Language Server

Clojure YARA-style pattern matching - malware signatures, hex/ascii/regex patterns

Performs OCR on image files and scans them for matches to YARA rules

Python 3 tool to parse Yara rules (extension of yarabuilder)

Yara rule generator using VirusTotal code similarity feature code-similar-to:

Yara integrated software to handle archive file data.

IDA Processor for Compiled YARA Rules

Repository that contains a set of purposefully erroneous Yara rules.

#supply #chain #attack #detection

Collaborative malware analysis framework

Factual-rules-generator is an open source project which aims to generate YARA rules about installed software from a machine.

Validates yara rules and tries to repair the broken ones.

Arya is a unique tool that produces pseudo-malicious files meant to trigger YARA rules. You can think of it like a reverse YARA.

Incident Response - Fast suspicious file finder

Incident Response & Digital Forensics Debugging Extension

CrowdStrike Feed Management System. CrowdFMS is a framework for automating collection and processing of samples from VirusTotal, by leveraging the Private API system. This framework automatically downloads recent samples, which triggered an alert on the users YARA notification feed.

YARA rule metadata specification and validation utility / Spécification et validation pour les règles YARA

BinaryAlert: Serverless, Real-time & Retroactive Malware Detection.