malware-analysis

There are 303 repositories under malware-analysis topic.

x64dbg
x64dbg / x64dbg
An open-source user mode debugger for Windows. Optimized for reverse engineering and malware analysis.
debugger windows x64 disassembler reverse-engineering security x86 x86-64 malware-analysis security-tools binary-analysis ctf dynamic-analysis exploit-development hacking oscp debugging program-analysis cybersecurity offensive-security
Language:C++ 47165
radareorg / radare2
UNIX-like reverse engineering framework and command-line toolset
binary-analysis c commandline disassembler forensics hacktoberfest malware-analysis radare2 reverse-engineering security
Language:C 22556
Mobile-Security-Framework-MobSF
MobSF / Mobile-Security-Framework-MobSF
Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.
static-analysis dynamic-analysis mobsf android-security mobile-security windows-mobile-security ios-security api-testing web-security malware-analysis runtime-security devsecops apk rest cwe owasp mstg masvs mastg
Language:JavaScript 19749
rshipp / awesome-malware-analysis
Defund the Police.
analysis-framework automated-analysis awesome awesome-list chinese chinese-translation domain-analysis drop-ice dynamic-analysis list malware-analysis malware-collection malware-research malware-samples network-traffic static-analysis threat-intelligence threat-sharing threatintel
13142
ytisf / theZoo
A repository of LIVE malwares for your own joy and pleasure. theZoo is a project created to make the possibility of malware analysis open and available to the public.
malware malware-analysis malware-research malware-samples malwareanalysis thezoo
Language:Python 12394
Detect-It-Easy
horsicq / Detect-It-Easy
Program for determining types of files for Windows, Linux and MacOS.
binary-analysis debugger detect detector disassembler elf entropy hacktoberfest hacktoberfest2023 mach-o macho malware-analysis malware-research packer pentest program-analysis reverse-engineering scanner static-analysis unpacker
Language:JavaScript 9587
pwndbg
pwndbg / pwndbg
Exploit Development and Reverse Engineering with GDB & LLDB Made Easy
python gdb pwndbg reverse-engineering debugging ctf gef linux disassembler ida-pro binary-ninja capture-the-flag malware-analysis pwnable exploit-development hacking-tool lldb low-level
Language:Python 9564
Scanners-Box
We5ter / Scanners-Box
A powerful and open-source toolkit for hackers and security automation - 安全行业从业者自研开源扫描器合辑
apk-analysis binary-analysis code-analyzer devsecops exploitation-framework hacker-tools information-security malware-analysis penetration-testing pentesting-tools privacy-compliance redteam-tools security-audit security-automation smart-contracts static-analysis vulnerability-scanners wifi-hacking wifi-security
8680
mandiant / flare-vm
A collection of software installations scripts for Windows systems that allows you to easily setup and maintain a reverse engineering environment on a VM.
flare malware-analysis reverse-engineering
Language:PowerShell 7966
gef
hugsy / gef
GEF (GDB Enhanced Features) - a modern experience for GDB with advanced debugging capabilities for exploit devs & reverse engineers on Linux
python exploit gdb linux reverse-engineering ctf ida-pro binary-ninja pwn exploit-development debugging malware-analysis pwntools powerpc sparc mips discord gef python-api
Language:Python 7847
bee-san / pyWhat
🐸 Identify anything. pyWhat easily lets you identify emails, IP addresses, and more. Feed it a .pcap file or some text and it'll tell you what it is! 🧙‍♀️
cyber security hacking cybersecurity malware re python pcap malware-analysis malware-research tryhackme hacktoberfest
Language:Python 7077
MISP / MISP
MISP (core software) - Open Source Threat Intelligence and Sharing Platform
misp threat-sharing threat-hunting threatintel malware-analysis stix information-exchange fraud-management security cti cybersecurity fraud-detection fraud-prevention threat-analysis information-security information-sharing threat-intelligence threat-intelligence-platform intelligence threat-intel
Language:PHP 5995
capa
mandiant / capa
The FLARE team's open-source tool to identify capabilities in executable files.
malware-analysis reverse-engineering binary-analysis threat-intelligence gsoc-2025
Language:Python 5641
lief-project / LIEF
LIEF - Library to Instrument Executable Formats (C++, Python, Rust)
reverse-engineering malware-analysis binary-analysis parser modification executable-formats elf macho pe lief parsing sdk python android dex oat art vdex rust
Language:C++ 5113
mentebinaria / retoolkit
Reverse Engineer's Toolkit
malware-analysis reverse-engineering windows
Language:Inno Setup 5110
CalebFenton / simplify
Android virtual machine and deobfuscator
android android-malware dalvik deobfuscation deobfuscator emulator java malware malware-analysis malware-analyzer malware-research optimization reverse-engineer-apk reverse-engineering virtual-machine
Language:Java 4590
charles2gan / GDA-android-reversing-Tool
the fastest and most powerful android decompiler(native tool working without Java VM) for the APK, DEX, ODEX, OAT, JAR, AAR, and CLASS file. which supports malicious behavior detection, privacy leaking detection, vulnerability detection, path solving, packer identification, variable tracking, deobfuscation, python&java scripts, device memory extraction, data decryption, and encryption, etc.
decompiler vulnerability-scanners malware-analysis security-audit mobile-security privacy-protection
Language:Java 4587
IntelOwl
intelowlproject / IntelOwl
IntelOwl: manage your Threat Intelligence at scale
security-tools python threat-intelligence ioc incident-response cyber-threat-intelligence enrichment honeynet osint osint-python threatintel malware-analysis malware-analyzer intel-owl threat-hunting hacktoberfest cyber-security cybersecurity threathunting dfir
Language:Python 4342
InQuest / awesome-yara
A curated list of awesome YARA rules, tools, and people.
awesome awesome-list awesome-yara ioc malware-analysis malware-detection malware-research malware-rules threat-hunting yara yara-manager yara-rules yara-scanner yara-signatures
4063
a0rtega / pafish
Pafish is a testing tool that uses different techniques to detect virtual machines and malware analysis environments in the same way that malware families do
malware reverse-engineering virtual-machine malware-families analysis-environments sandbox malware-analysis rdtsc malware-research
Language:C 3807
flare-floss
mandiant / flare-floss
FLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.
deobfuscation flare gsoc-2025 malware malware-analysis strings
Language:Python 3766
APKLab
APKLab / APKLab
Android Reverse-Engineering Workbench for VS Code
apktool apk-decompiler apk-editor smali dalvik smalidea apksigner apk-studio android jadx reverse-engineering bytecode mitm malware-analysis app-analyzer malware-detection uber-apk-signer https-inspection
Language:TypeScript 3609
HyperDbg
HyperDbg / HyperDbg
State-of-the-art native debugging tools
hypervisor hyperdbg debugger ept windows-kernel hook kernel-debugger debug binary-analysis malware-analysis reverse-engineering security security-tools debugging debugging-tool logic-analyzer virtualization virtualization-framework
Language:C 3512
hasherezade / pe-sieve
Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).
pe-format hooking pe-dumper pe-analyzer libpeconv process-analyzer scans anti-malware pe-sieve malware-analysis memory-forensics
Language:C++ 3471
alexandreborges / malwoverview
Malwoverview is a first response tool used for threat hunting and offers intel information from Virus Total, Hybrid Analysis, URLHaus, Polyswarm, Malshare, Alien Vault, Malpedia, Malware Bazaar, ThreatFox, Triage, InQuest, VxExchange and IPInfo, and it is also able to scan Android devices against VT.
malware virustotal malpedia urlhaus alienvault malshare threathunting malwarebazaar threatfox cybersecurity malware-analysis threat-hunting threatintelligence triage
Language:Python 3457
BlueTeam-Tools
A-poc / BlueTeam-Tools
Tools and Techniques for Blue Team / Incident Response
blue-team blueteam cheatsheet incident-response malware-analysis tools vulnerability-management wiki incident resources cyber-security defender
3441
hasherezade / pe-bear
Portable Executable reversing tool with a friendly GUI
pe-file pe-format pe-analyzer pe-analyzer-gui pe-editor multiplatform malware-analysis bearparser
Language:C++ 3340
decalage2 / oletools
oletools - python tools to analyze MS OLE2 files (Structured Storage, Compound File Binary Format) and MS Office documents, for malware analysis, forensics and debugging.
compound forensics macros malware-analysis ms-office-documents ole-files olefile parser pyparsing python python-library rtf security vba
Language:Python 3216
Ultimate-RAT-Collection
Cryakl / Ultimate-RAT-Collection
For educational purposes only, exhaustive samples of 500+ classic/modern trojan builders including screenshots.
backdoor-attacks backdoors malware malware-analysis malware-database malware-dataset malware-research malware-sample malware-samples rat remote-control trojan trojan-malware
3151
kevoreilly / CAPEv2
Malware Configuration And Payload Extraction
configs debugging-tools malware malware-analysis malware-research reverse-engineering sandbox unpacking cape
Language:Python 2784
APKiD
rednaga / APKiD
Android Application Identifier for Packers, Protectors, Obfuscators and Oddities - PEiD for Android
android antivirus machine-learning malware-detection malware-analysis malware-research yara yara-forensics packers android-protection android-protect-apps rasp appshielding obfuscation
Language:YARA 2336
hasherezade / hollows_hunter
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
anti-malware malware-analysis malware-detection memory-forensics pe-sieve
Language:C 2263
alphaSeclab / awesome-rat
RAT And C&C Resources. 250+ Open Source Projects, 1200+ RAT/C&C blog/video.
c2 command-and-control command-control malware-analysis rat rat-analysis rat-malware remote-access-tool remote-administration-tool
2129
mandiant / flare-fakenet-ng
FakeNet-NG - Next Generation Dynamic Network Analysis Tool
fakenet-ng traffic-redirection malware-analysis mandiant-flare gsoc-2025
Language:Python 2025
hasherezade / malware_training_vol1
Materials for Windows Malware Analysis training (volume 1)
malware-analysis malware-research windows-malware-analysis
Language:Assembly 2011
JKornev / hidden
🇺🇦 Windows driver with usermode interface which can hide processes, file-system and registry objects, protect processes and etc
windows security malware-analysis registry driver kernel rootkit rce
Language:C 1969