MalwareMechanic

RISCYpacker

Process Hollowing Packer

loader

Resident Http(s) Command Execution Bot

malware

malware source codes

Win32.Stolich

A Polymorphic, RSA 4096 AES 256, Crypter that demands BitCoins (statically)

CodeMachineCourse

CyberChef

The Cyber Swiss Army Knife - a web app for encryption, encoding, compression and data analysis

QuasarRAT

Remote Administration Tool for Windows

VM-Packages

BotKiller

find and kill injectedThreads from memory

boxstarter

Repeatable, reboot resilient windows environment installations made easy using Chocolatey packages

capa-rules

Standard collection of rules for capa: the tool for enumerating the capabilities of programs

capa-testfiles

ConfuserEx

An open-source, free protector for .NET applications

Crypter-2

dedrop

Looking inside the (Drop) box. Security Analysis of Dropbox. Updated WOOT '13 paper and other goodies.

diablo

Diablo is a retargetable link-time binary rewriting framework

fancybear

Fancy Bear Source Code

FileInsight-plugins

FileInsight-plugins: tiny plugins for McAfee FileInsight hex editor useful for various kind of decoding tasks in malware analysis.

flare-qdb

Command-line and Python debugger for instrumenting and modifying native software behavior on Windows and Linux.

MalwareMechanic.github.io

Maxwell

pefile

pefile is a Python module to read and work with PE (Portable Executable) files

pocs

Proof of Concepts (PE, PDF...)

PortEx

Java library to analyse Portable Executable files with a special focus on malware analysis and PE malformation robustness

POSHSPY

POSHSPY backdoor code

rootkit.com

Mirror of users section of rootkit.com

snippets

pieces of dirty quick code. possible error checking or none.

test_repo

test_volatility

An advanced memory forensics framework

TinyNuke

zeus-style banking trojan