threathive

urlhaus

urlhaus api client

binja-emotet

capa

The FLARE team's open-source tool to identify capabilities in executable files.

CAPEv2

Malware Configuration And Payload Extraction

dhp

Simple Docker Honeypot server emulating small snippets of the Docker HTTP API

ditto

A tool for IDN homograph attacks and detection.

dmon

A little app to monitor domains

domain_generation_algorithms

Some results of my DGA reversing efforts

EmerSearch

Search Emercoin NVS records

EyeWitness

EyeWitness is designed to take screenshots of websites, provide some server header info, and identify default credentials if possible.

flare-fakenet-ng

FakeNet-NG - Next Generation Dynamic Network Analysis Tool

flare-qdb

Command-line and Python debugger for instrumenting and modifying native software behavior on Windows and Linux.

httpreplay

Replay HTTP and HTTPS requests from a PCAP based on TLS Master Secrets.

karton-playground

kit_hunter

A basic phishing kit scanner for dedicated and semi-dedicated hosting

loguru

Python logging made (stupidly) simple

malwarebazaar

Malware Bazaar Python Client

medusa

Binary instrumentation framework based on FRIDA

miasm

Reverse engineering framework in Python

netinfo

Simple IP enrichment service and API wrapping PyASN and MaxMind GeoIP.

passivedns

A network sniffer that logs all DNS server replies for use in a passive DNS setup

peframe

PEframe is a open source tool to perform static analysis on Portable Executable malware and malicious MS Office documents.

phishpond

Because phishtank was taken.. explore phishing kits in a contained environment!

PyPDNS

Client API to query any Passive DNS implementation following the Passive DNS - Common Output Format.

sflock

Sample staging & detonation utility to be used in combination with Cuckoo Sandbox.

socks5man

Socks5man is a Socks5 management tool and Python library

StalkPhish

StalkPhish - The Phishing kits stalker, harvesting phishing kits for investigations.

Tools

Combination of different utilities, have fun!

VMwareCloak

A PowerShell script that attempts to help malware analysts hide their VMware Windows VM's from malware that may be trying to evade analysis.

vpnrotator

VPN Rotator