ch0ic3/awesome-malware-analysis
1
0
Fork 0
mirror of https://github.com/rshipp/awesome-malware-analysis.git synced 2024-12-20 03:06:08 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Add tools

Browse Source
This commit is contained in:
Patrik Hudak 2016-04-16 13:37:35 +02:00
parent 5b108cfb9b
commit 67aef88228
1 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
README.md
View File

@ -260,10 +260,12 @@ A curated list of awesome malware analysis tools and resources. Inspired by
much metadata as possible for a website and to assess its good standing. much metadata as possible for a website and to assess its good standing.
* [Dig](http://networking.ringofsaturn.com/) - Free online dig and other * [Dig](http://networking.ringofsaturn.com/) - Free online dig and other
network tools. network tools.
* [dnstwist](https://github.com/elceef/dnstwist) - Domain name permutation engine for detecting typo squatting, phishing and corporate espionage
* [IPinfo](https://github.com/hiddenillusion/IPinfo) - Gather information * [IPinfo](https://github.com/hiddenillusion/IPinfo) - Gather information
about an IP or domain by searching online resources. about an IP or domain by searching online resources.
* [Machinae](https://github.com/hurricanelabs/machinae) - OSINT tool for * [Machinae](https://github.com/hurricanelabs/machinae) - OSINT tool for
gathering information about URLs, IPs, or hashes. Similar to Automator. gathering information about URLs, IPs, or hashes. Similar to Automator.
* [mailchecker](https://github.com/FGRibreau/mailchecker) - Cross-language temporary email detection library
* [MaltegoVT](https://github.com/jiachongzhi/MaltegoVT) - Maltego * [MaltegoVT](https://github.com/jiachongzhi/MaltegoVT) - Maltego
transform for the VirusTotal API. Allows domain/IP research, and searching transform for the VirusTotal API. Allows domain/IP research, and searching
for file hashes and scan reports. for file hashes and scan reports.
@ -296,6 +298,7 @@ A curated list of awesome malware analysis tools and resources. Inspired by
malware analysis tool. malware analysis tool.
* [jsunpack-n](https://github.com/urule99/jsunpack-n) - A javascript * [jsunpack-n](https://github.com/urule99/jsunpack-n) - A javascript
unpacker that emulates browser functionality. unpacker that emulates browser functionality.
* [Krakatau](https://github.com/Storyyeller/Krakatau) - Java decompiler, assembler, and disassembler
* [Malzilla](http://malzilla.sourceforge.net/) - Analyze malicious web pages. * [Malzilla](http://malzilla.sourceforge.net/) - Analyze malicious web pages.
* [RABCDAsm](https://github.com/CyberShadow/RABCDAsm) - A "Robust * [RABCDAsm](https://github.com/CyberShadow/RABCDAsm) - A "Robust
ActionScript Bytecode Disassembler." ActionScript Bytecode Disassembler."
@ -418,6 +421,7 @@ the [browser malware](#browser-malware) section.*
Assistance for GDB, an enhanced display with added commands. Assistance for GDB, an enhanced display with added commands.
* [pestudio](https://winitor.com/) - Perform static analysis of Windows * [pestudio](https://winitor.com/) - Perform static analysis of Windows
executables. executables.
* [plasma](https://github.com/joelpx/plasma) - Interactive disassembler for x86/ARM/MIPS
* [Process Monitor](https://technet.microsoft.com/en-us/sysinternals/bb896645.aspx) - * [Process Monitor](https://technet.microsoft.com/en-us/sysinternals/bb896645.aspx) -
Advanced monitoring tool for Windows programs. Advanced monitoring tool for Windows programs.
* [Pyew](https://github.com/joxeankoret/pyew) - Python tool for malware * [Pyew](https://github.com/joxeankoret/pyew) - Python tool for malware
@ -449,6 +453,7 @@ the [browser malware](#browser-malware) section.*
* [Fiddler](http://www.telerik.com/fiddler) - Intercepting web proxy designed * [Fiddler](http://www.telerik.com/fiddler) - Intercepting web proxy designed
for "web debugging." for "web debugging."
* [Hale](https://github.com/pjlantz/Hale) - Botnet C&C monitor. * [Hale](https://github.com/pjlantz/Hale) - Botnet C&C monitor.
* [Haka](http://www.haka-security.org/) - Haka is an open source security oriented language which allows to describe protocols and apply security policies on (live) captured traffic
* [INetSim](http://www.inetsim.org/) - Network service emulation, useful when * [INetSim](http://www.inetsim.org/) - Network service emulation, useful when
building a malware lab. building a malware lab.
* [Laika BOSS](https://github.com/lmco/laikaboss) - Laika BOSS is a file-centric * [Laika BOSS](https://github.com/lmco/laikaboss) - Laika BOSS is a file-centric
@ -481,6 +486,7 @@ the [browser malware](#browser-malware) section.*
* [DAMM](https://github.com/504ensicsLabs/DAMM) - Differential Analysis of * [DAMM](https://github.com/504ensicsLabs/DAMM) - Differential Analysis of
Malware in Memory, built on Volatility Malware in Memory, built on Volatility
* [evolve](https://github.com/JamesHabben/evolve) - Web interface for the Volatility Memory Forensics Framework
* [FindAES](http://jessekornblum.livejournal.com/269749.html) - Find AES * [FindAES](http://jessekornblum.livejournal.com/269749.html) - Find AES
encryption keys in memory. encryption keys in memory.
* [Muninn](https://github.com/ytisf/muninn) - A script to automate portions * [Muninn](https://github.com/ytisf/muninn) - A script to automate portions
@ -493,6 +499,7 @@ the [browser malware](#browser-malware) section.*
images before and after malware execution, and report changes. images before and after malware execution, and report changes.
* [Volatility](https://github.com/volatilityfoundation/volatility) - Advanced * [Volatility](https://github.com/volatilityfoundation/volatility) - Advanced
memory forensics framework. memory forensics framework.
* [VolUtility](https://github.com/kevthehermit/VolUtility) - Web Interface for Volatility Memory Analysis framework
* [WinDbg](https://msdn.microsoft.com/en-us/windows/hardware/hh852365) - Live * [WinDbg](https://msdn.microsoft.com/en-us/windows/hardware/hh852365) - Live
memory inspection and kernel debugging for Windows systems. memory inspection and kernel debugging for Windows systems.
@ -514,6 +521,7 @@ the [browser malware](#browser-malware) section.*
Pipeline System. Pipeline System.
* [CRITs](https://crits.github.io/) - Collaborative Research Into Threats, a * [CRITs](https://crits.github.io/) - Collaborative Research Into Threats, a
malware and threat repository. malware and threat repository.
* [Laika BOSS](https://github.com/lmco/laikaboss) - Object Scanning System
* [Malwarehouse](https://github.com/sroberts/malwarehouse) - Store, tag, and * [Malwarehouse](https://github.com/sroberts/malwarehouse) - Store, tag, and
search malware. search malware.
* [Viper](http://viper.li/) - A binary management and analysis framework for * [Viper](http://viper.li/) - A binary management and analysis framework for
@ -569,6 +577,7 @@ the [browser malware](#browser-malware) section.*
* [APT Notes](https://github.com/kbandla/APTnotes) - A collection of papers * [APT Notes](https://github.com/kbandla/APTnotes) - A collection of papers
and notes related to Advanced Persistent Threats. and notes related to Advanced Persistent Threats.
* [File Formats posters](https://github.com/corkami/pics) - Nice visualization of commonly used file format (including PE & ELF)
* [Honeynet Project](http://honeynet.org/) - Honeypot tools, papers, and * [Honeynet Project](http://honeynet.org/) - Honeypot tools, papers, and
other resources. other resources.
* [Kernel Mode](http://www.kernelmode.info/forum/) - An active community devoted to * [Kernel Mode](http://www.kernelmode.info/forum/) - An active community devoted to
@ -586,6 +595,7 @@ the [browser malware](#browser-malware) section.*
Institute during Fall 2015. Institute during Fall 2015.
* [WindowsIR: Malware](http://windowsir.blogspot.com/p/malware.html) - Harlan * [WindowsIR: Malware](http://windowsir.blogspot.com/p/malware.html) - Harlan
Carvey's page on Malware. Carvey's page on Malware.
* [Windows Registry specification](https://github.com/msuhanov/regf/blob/master/Windows%20registry%20file%20format%20specification.md) - Windows registry file format specification
* [/r/csirt_tools](https://www.reddit.com/r/csirt_tools/) - Subreddit for CSIRT * [/r/csirt_tools](https://www.reddit.com/r/csirt_tools/) - Subreddit for CSIRT
tools and resources, with a tools and resources, with a
[malware analysis](https://www.reddit.com/r/csirt_tools/search?q=flair%3A%22Malware%20analysis%22&sort=new&restrict_sr=on) flair. [malware analysis](https://www.reddit.com/r/csirt_tools/search?q=flair%3A%22Malware%20analysis%22&sort=new&restrict_sr=on) flair.