Collection of scripts for different malware analysis tasks
Some of these scripts are mine. Some of them are not. I have had many of these stored for a
long time and I will try to make sure credit for others work is given where due, though
sometimes I no longer know who the original author actually is.
If you happen to see code you recognize here please let me know in a Issue so I can assign
proper credit.
This README will be used to keep track of the contents of this repo, what each script does
and hopefully who the original authors are, if it is not myself.
-
getstatic.py (deadbits)
-
getimps.py (deadbits)
-
domain_registrant.py (deadbits)
-
gozi-c2-craft.py (deadbits)
-
malshare_dl.py (deadbits)
-
http_forge.py (deadbits)
-
irc_stealth.py (deadbits)
-
local2splunk.py (deadbits)
-
lookup_dns.py (deadbits)
-
mass_nmap.py (deadbits)
-
maz_slim.py (deadbits)
-
memdump.c (travis montoya)
-
blackenergy.py (Malware.lu)
-
bozok_config.py (Malware.lu)
-
vt-notify.rb (author unknown)
-
binextract.py (author unknown)
-
anubis.py (author unknown)
-
decodebhek.py (author unknown)
-
cifcsv.py (author unknown)
-
magic.py (author unknown)
-
match.py (author unknown)
-
phpdecode.py (author unknown)
-
xorencode.c (author unkown - maybe myself? really dont remember..)
-
xortools.py (author unknown)
-
fake_dns.py (author unknown)
-
darkcomet_config.py (https://bitbucket.org/r3shl4k1sh)
-
atrax-root.py (siph0n)
-
pescanner.py (Michael Ligh)
-
avsubmit.py (Michael Ligh)
-
db-artifacts.py (Michael Ligh)
-
backtrack.py (Alexander Hanel)
-
import_snapshop.py (Alexander Hanel)
-
vt_pyscan.py (Alexander Hanel)
-
AnalyzePE.py (hiddenillusion)
-
IPInfo.py (hiddenillusion)
-
Automater.py (TekDefense.com)
-
wepewet.py (wepawet@cs.ucsb.edu)