f0wl

Triton

Triton is a dynamic binary analysis library. Build your own program analysis tools, automate your reverse engineering, perform software verification or just emulate code.

chainsaw

Rapidly Search and Hunt through Windows Forensic Artefacts

hayabusa

Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.

rekall

Rekall Memory Forensic Framework

bkcrack

Crack legacy zip encryption with Biham and Kocher's known plaintext attack.

osintui

OSINT from your favorite services in a friendly terminal user interface - integrations for Virustotal, Shodan, and Censys

ntlm_theft

A tool for generating multiple types of NTLMv2 hash theft files by Jacob Wilkin (Greenwolf)

dirble

Fast directory scanning and scraping tool

JADXecute

JADX-gui scripting plugin for dynamic decompiler manipulation

bitscout

Remote forensics meta tool

sharem

SHAREM is a shellcode analysis framework, capable of emulating more than 20,000 WinAPIs and virutally all Windows syscalls. It also contains its own custom disassembler, with many innovative features, such as being able to show the deobfuscated disassembly of an encoded shellcode, or integrating emulation data to enhance the disassembly.

evil-mhyprot-cli

A PoC for Mhyprot2.sys vulnerable driver that allowing read/write memory in kernel/user via unprivileged user process.

DotDumper

An automatic unpacker and logger for DotNet Framework targeting files

pandora

Pandora is an analysis framework to discover if a file is suspicious and conveniently show the results

PsyloDbg

User-friendly Microsoft Windows Debugger for Malware Analysts.

VISION-ProcMon

A ProcessMonitor visualization application written in rust.

quokka

Quokka: A Fast and Accurate Binary Exporter

yaralyzer

Visually inspect and force decode YARA and regex matches found in both binary and text data. With Colors.

yxd

yxd - Yuu's heX Dumper

yari

YARI is an interactive debugger for YARA Language.

upx-recovery-tool

AutoResolv

2024

Rules shared by the community from 100 Days of YARA 2024

apkingo

extract info from apk files

HiveV5_keystream_decryptor

bad stuffs by bad guys

pecoret

A Pentest Collaboration and Reporting Tool

TimeDateStamp

Discover TimeDateStamps In PE File

smoke_conf_extract

100daysOfYaraForOT

Operational Technology related Yara rules for the 2024 #100daysofYARA challenge. #OT #ICS #SCADA

zeek-exfil-detect

This Zeek package provides the possibility to detect exfiltration through statistical analysis methods.