AbuseHelper - An open-source
framework for receiving and redistributing abuse feeds and threat intel.

AlienVault Open Threat Exchange - Share and
collaborate in developing Threat Intelligence.

Combine - Tool to gather Threat
Intelligence indicators from publicly available sources.

Fileintel - Pull intelligence per file hash.

IntelMQ -
A tool for CERTs for processing incident data using a message queue.

IOC Editor -
A free editor for XML IOC files.

iocextract - Advanced Indicator
of Compromise (IOC) extractor, Python library and command-line tool.

ioc_writer - Python library for
working with OpenIOC objects, from Mandiant.

MalPipe - Malware/IOC ingestion and
processing engine, that enriches collected data.

Massive Octo Spice -
Previously known as CIF (Collective Intelligence Framework). Aggregates IOCs
from various lists. Curated by the


MISP - Malware Information Sharing
Platform curated by 

Pulsedive - Free, community-driven threat intelligence platform collecting IOCs from open-source feeds.

RiskIQ - Research, connect, tag and
share IPs and domains. (Was PassiveTotal.)

threataggregator -
Aggregates security threats from a number of sources, including some of
those listed below in 

ThreatConnect - TC Open allows you to see and
share open source threat data, with support and validation from our free community.

ThreatCrowd - A search engine for threats,
with graphical visualization.

ThreatIngestor - Build
automated threat intel pipelines sourcing from Twitter, RSS, GitHub, and
more.

ThreatTracker - A Python
script to monitor and generate alerts based on IOCs indexed by a set of
Google Custom Search Engines.

TIQ-test - Data visualization
and statistical analysis of Threat Intelligence feeds.

Learning Malware Analysis - Learning Malware Analysis: Explore the concepts, tools, and techniques to analuze and investigate Windows malware

Malware Analyst's Cookbook and DVD -
Tools and Techniques for Fighting Malicious Code.

Mastering Malware Analysis - Mastering Malware Analysis: The complete malware analyst's guide to combating malicious software, APT, cybercime, and IoT attacks

Mastering Reverse Engineering - Mastering Reverse Engineering: Re-engineer your ethical hacking skills

Practical Malware Analysis - The Hands-On
Guide to Dissecting Malicious Software.

Practical Reverse Engineering -
Intermediate Reverse Engineering.

Real Digital Forensics - Computer
Security and Incident Response.

Rootkits and Bootkits - Rootkits and Bootkits: Reversing Modern Malware and Next Generation Threats

The Art of Memory Forensics - Detecting
Malware and Threats in Windows, Linux, and Mac Memory.

The IDA Pro Book - The Unofficial Guide
to the World's Most Popular Disassembler.

The Rootkit Arsenal - The Rootkit Arsenal:
Escape and Evasion in the Dark Corners of the System

Lenny Zeltser and other contributors for developing REMnux, where I
found many of the tools in this

Michail Hale Ligh, Steven Adair, Blake Hartstein, and Mather Richard for
writing the

And everyone else who has sent pull requests or suggested links to add

Bro - Protocol analyzer that operates at incredible
scale; both file and network protocols.

CapTipper -  Malicious HTTP traffic
explorer.

chopshop - Protocol analysis and
decoding framework.

CloudShark - Web-based tool for packet analysis
and malware traffic detection.

FakeNet-NG - Next generation
dynamic network analysis tool.

Fiddler - Intercepting web proxy designed
for "web debugging."

Haka - An open source security oriented
language for describing protocols and applying security policies on (live)
captured traffic.

HTTPReplay - Library for parsing
and reading out PCAP files, including TLS streams using TLS Master Secrets
(used in Cuckoo Sandbox).

INetSim - Network service emulation, useful when
building a malware lab.

Laika BOSS - Laika BOSS is a file-centric
malware analysis and intrusion detection system.

Malcolm - Malcolm is a powerful, easily
deployable network traffic analysis tool suite for full packet capture artifacts
(PCAP files) and Zeek logs.

Malcom - Malware Communications
Analyzer.

Maltrail - A malicious traffic
detection system, utilizing publicly available (black)lists containing
malicious and/or generally suspicious trails and featuring an reporting
and analysis interface.

mitmproxy - Intercept network traffic on the fly.

Moloch - IPv4 traffic capturing, indexing
and database system.

NetworkMiner - Network
forensic analysis tool, with a free version.

ngrep - Search through network traffic
like grep.

PcapViz - Network topology and
traffic visualizer.

Python ICAP Yara - An
ICAP Server with yara scanner for URL or content.

Squidmagic - squidmagic is a tool
designed to analyze a web-based network traffic to detect central command
and control (C&amp;C) servers and malicious sites, using Squid proxy server and
Spamhaus.

tcpick - Trach and reassemble TCP streams
from network traffic.

tcpxtract - Extract files from network
traffic.

Wireshark - The network traffic analysis
tool.

DemoHunter - Low interaction Distributed Honeypots.

Dionaea - Honeypot designed to trap malware.

HoneyDrive - Honeypot bundle Linux distro.

Honeytrap - Opensource system for running, monitoring and managing honeypots.

MHN - MHN is a centralized server for management and data collection of honeypots. MHN allows you to deploy sensors quickly and to collect data immediately, viewable from a neat web interface.

Mnemosyne - A normalizer for
honeypot data; supports Dionaea.

Thug - Low interaction honeyclient, for
investigating malicious websites.

Anonymouse.org - A free, web based anonymizer.

OpenVPN - VPN software and hosting solutions.

Privoxy - An open source proxy server with some
privacy features.

Tor - The Onion Router, for browsing the web
without leaving traces of the client IP.

EVTXtract - Carve Windows
Event Log files from raw binary data.

Foremost - File carving tool designed
by the US Air Force.

hachoir3 - Hachoir is a Python library
to view and edit a binary stream field by field.

SFlock - Nested archive
extraction/unpacking (used in Cuckoo Sandbox).

Balbuzard - A malware
analysis tool for reversing obfuscation (XOR, ROL, etc) and more.

FLOSS - The FireEye Labs Obfuscated
String Solver uses advanced static analysis techniques to automatically
deobfuscate strings from malware binaries.

NoMoreXOR - Guess a 256 byte
XOR key using frequency analysis.

PackerAttacker - A generic
hidden code extractor for Windows malware.

PyInstaller Extractor -
A Python script to extract the contents of a PyInstaller generated Windows
executable file. The contents of the pyz file (usually pyc files) present
inside the executable are also extracted and automatically fixed so that a
Python bytecode decompiler will recognize it.

uncompyle6 - A cross-version
Python bytecode decompiler.  Translates Python bytecode back into equivalent
Python source code.

un{i}packer - Automatic and
platform-independent unpacker for Windows binaries based on emulation.

unpacker - Automated malware
unpacker for Windows malware based on WinAppDbg.

unxor - Guess XOR keys using
known-plaintext attacks.

VirtualDeobfuscator -
Reverse engineering tool for virtualization wrappers.

XORBruteForcer -
A Python script for brute forcing single-byte XOR keys.

XORSearch & XORStrings -
A couple programs from Didier Stevens for finding XORed data.

xortool - Guess XOR key length, as
well as the key itself.

al-khaser - A PoC malware
with good intentions that aimes to stress anti-malware systems.

CryptoKnight - Automated cryptographic algorithm reverse engineering and classification framework.

DC3-MWCP -
The Defense Cyber Crime Center's Malware Configuration Parser framework.

FLARE VM - A fully customizable,
Windows-based, security distribution for malware analysis.

MalSploitBase - A database
containing exploits used by malware.

Malware Museum - Collection of
malware programs that were distributed in the 1980s and 1990s.

Malware Organiser - A simple tool to organise large malicious/benign files into a organised Structure.

Pafish - Paranoid Fish, a demonstration
tool that employs several techniques to detect sandboxes and analysis
environments in the same way as malware families do.

REMnux - Linux distribution and docker images for
malware reverse engineering and analysis.

Tsurugi Linux - Linux distribution designed to support your DFIR investigations, malware analysis and OSINT (Open Source INTelligence) activities.

Santoku Linux - Linux distribution for mobile
forensics, malware analysis, and security.

Clean MX - Realtime
database of malware and malicious domains.

Contagio - A collection of recent
malware samples and analyses.

Exploit Database - Exploit and shellcode
samples.

Infosec - CERT-PA - Malware samples collection and analysis.

InQuest Labs - Evergrowing searchable corpus of malicious Microsoft documents.

Javascript Mallware Collection - Collection of almost 40.000 javascript malware samples

Malpedia - A resource providing
rapid identification and actionable context for malware investigations.

Malshare - Large repository of malware actively
scrapped from malicious sites.

Open Malware Project - Sample information and
downloads. Formerly Offensive Computing.

Ragpicker - Plugin based malware
crawler with pre-analysis and reporting functionalities

theZoo - Live malware samples for
analysts.

Tracker h3x - Agregator for malware corpus tracker
and malicious download sites.

vduddu malware repo - Collection of
various malware files and source code.

VirusBay - Community-Based malware repository and social network.

ViruSign - Malware database that detected by
many anti malware programs except ClamAV.

VirusShare - Malware repository, registration
required.

VX Vault - Active collection of malware samples.

Zeltser's Sources - A list
of malware sample sources put together by Lenny Zeltser.

Zeus Source Code - Source for the Zeus
trojan leaked in 2011.

VX Underground - Massive and growing collection of free malware samples.

Bambenek Consulting Feeds -
OSINT feeds based on malicious DGA algorithms.

Fidelis Barncat -
Extensive malware config database (must request access).

Critical Stack- Free Intel Market - Free
intel aggregator with deduplication featuring 90+ feeds and over 1.2M indicators.

Cybercrime tracker - Multiple botnet active tracker.

FireEye IOCs - Indicators of Compromise
shared publicly by FireEye.

FireHOL IP Lists - Analytics for 350+ IP lists
with a focus on attacks, malware and abuse. Evolution, Changes History,
Country Maps, Age of IPs listed, Retention Policy, Overlaps.

HoneyDB - Community driven honeypot sensor data collection and aggregation.

InQuest REPdb - Continuous aggregation of IOCs from a variety of open reputation sources.

InQuest IOCdb - Continuous aggregation of IOCs from a variety of blogs, Github repos, and Twitter.

Internet Storm Center (DShield) - Diary and
searchable incident database, with a web 

Malware Domain List - Search and share
malicious URLs.

MetaDefender Threat Intelligence Feed -
List of the most looked up file hashes from MetaDefender Cloud.

OpenIOC - Framework for sharing threat intelligence.

Proofpoint Threat Intelligence -
Rulesets and more. (Formerly Emerging Threats.)

Ransomware overview -
A list of ransomware overview with details, detection and prevention.

STIX - Structured Threat Information eXpression -
Standardized language to represent and share cyber threat information.
Related efforts from 

CAPEC - Common Attack Pattern Enumeration and Classification

MAEC - Malware Attribute Enumeration and Characterization

TAXII - Trusted Automated eXchange of Indicator Information

SystemLookup - SystemLookup hosts a collection of lists that provide information on
the components of legitimate and potentially unwanted programs.

ThreatMiner - Data mining portal for threat
intelligence, with search.

threatRECON - Search for indicators, up to 1000
free per month.

YETI - Yeti is a platform meant to organize observables, indicators of compromise, TTPs, and knowledge on threats in a single, unified repository.

AbuseIPDB - AbuseIPDB is a project dedicated
to helping combat the spread of hackers, spammers, and abusive activity on the internet.

badips.com - Community based IP blacklist service.

boomerang - A tool designed
for consistent and safe capture of off network web resources.

Cymon - Threat intelligence tracker, with IP/domain/hash
search.

Desenmascara.me - One click tool to retrieve as
much metadata as possible for a website and to assess its good standing.

Dig - Free online dig and other
network tools.

dnstwist - Domain name permutation
engine for detecting typo squatting, phishing and corporate espionage.

IPinfo - Gather information
about an IP or domain by searching online resources.

Machinae - OSINT tool for
gathering information about URLs, IPs, or hashes. Similar to Automator.

mailchecker - Cross-language
temporary email detection library.

MaltegoVT - Maltego transform
for the VirusTotal API. Allows domain/IP research, and searching for file
hashes and scan reports.

Multi rbl - Multiple DNS blacklist and forward
confirmed reverse DNS lookup over more than 300 RBLs.

NormShield Services - Free API Services
for detecting possible phishing domains, blacklisted ip addresses and breached
accounts.

PhishStats - Phishing Statistics with search for
IP, domain and website title

Spyse - subdomains, whois, realted domains, DNS, hosts AS, SSL/TLS info,  

SecurityTrails - Historical and current WHOIS,
historical and current DNS records, similar domains, certificate information
and other domain and IP related API and tools.

SpamHaus - Block list based on
domains and IPs.

Sucuri SiteCheck - Free Website Malware
and Security Scanner.

Talos Intelligence - Search for IP, domain
or network owner. (Previously SenderBase.)

TekDefense Automater - OSINT tool
for gathering information about URLs, IPs, or hashes.

URLhaus - A project from abuse.ch with the goal
of sharing malicious URLs that are being used for malware distribution.

urlscan.io - Free URL Scanner &amp; domain information.

Whois - DomainTools free online whois
search.

Zeltser's List - Free
online tools for researching malicious websites, compiled by Lenny Zeltser.

Bytecode Viewer - Combines
multiple Java bytecode viewers and decompilers into one tool, including
APK/DEX support.

Firebug - Firefox extension for web development.

Java Decompiler - Decompile and inspect Java apps.

Java IDX Parser - Parses Java
IDX cache files.

JSDetox - JavaScript
malware analysis tool.

jsunpack-n - A javascript
unpacker that emulates browser functionality.

Krakatau - Java decompiler,
assembler, and disassembler.

RABCDAsm - A "Robust
ActionScript Bytecode Disassembler."

SWF Investigator -
Static and dynamic analysis of SWF applications.

swftools - Tools for working with Adobe Flash
files.

xxxswf - A
Python script for analyzing Flash files.

BlackLight - Windows/MacOS
forensics client supporting hiberfil, pagefile, raw memory analysis.

DAMM - Differential Analysis of
Malware in Memory, built on Volatility.

evolve - Web interface for the
Volatility Memory Forensics Framework.

FindAES - Find AES
encryption keys in memory.

inVtero.net - High speed memory
analysis framework developed in .NET supports all Windows x64, includes
code integrity and write support.

Muninn - A script to automate portions
of analysis using Volatility, and create a readable report.

Rekall - Memory analysis framework,
forked from Volatility in 2013.

TotalRecall - Script based
on Volatility for automating various malware analysis tasks.

VolDiff - Run Volatility on memory
images before and after malware execution, and report changes.

Volatility - Advanced
memory forensics framework.

VolUtility - Web Interface for
Volatility Memory Analysis framework.

WinDbg -
Live memory inspection and kernel debugging for Windows systems.

AChoir - A live incident response
script for gathering Windows artifacts.

python-evt - Python
library for parsing Windows Event Logs.

python-registry - Python
library for parsing registry files.

Aleph - Open Source Malware Analysis
Pipeline System.

CRITs - Collaborative Research Into Threats, a
malware and threat repository.

FAME - A malware analysis
framework featuring a pipeline that can be extended with custom modules,
which can be chained and interact with each other to perform end-to-end
analysis.

Malwarehouse - Store, tag, and
search malware.

Polichombr - A malware analysis
platform designed to help analysts to reverse malwares collaboratively.

stoQ - Distributed content analysis
framework with extensive plugin support, from input to output, and everything
in between.

Viper - A binary management and analysis framework for
analysts and researchers.

AnalyzePDF - A tool for
analyzing PDFs and attempting to determine whether they are malicious.

box-js - A tool for studying JavaScript
malware, featuring JScript/WScript support and ActiveX emulation.

diStorm - Disassembler for analyzing
malicious shellcode.

InQuest Deep File Inspection - Upload common malware lures for Deep File Inspection and heuristical analysis.

JS Beautifier - JavaScript unpacking and deobfuscation.

libemu - Library and tools for x86 shellcode
emulation.

Repository of MALWARE ANALYSIS Resources in December 2024

Select category under malware-analysis projects and apps that you are looking to build in December 2024

Last Updated: 18 December 2024

Repository of malware analysis Resources

Subscribe to our Newsletter

Company

Follow Us

Subscribe to our Newsletter