github.comrepoAwesome Malware Analysis
Awesome Malware Analysis is a curated GitHub list aggregating hundreds of tools and resources across the malware analysis lifecycle: honeypots (Cowrie, Dionaea, Conpot), sample repositories (VirusShare, Malshare, theZoo, VX Underground), IOC/threat-intel platforms (MISP, YARA, ThreatCrowd, URLhaus), online sandboxes (VirusTotal, Cuckoo Sandbox, Hybrid Analysis, any.run), static/dynamic RE tools (IDA Pro, Ghidra, Radare2, x64dbg, angr), deobfuscation utilities, network traffic analyzers (Wireshark, Bro, mitmproxy), and memory forensics frameworks (Volatility, Rekall). It also links essential books, blogs, and training material (Practical Malware Analysis, REMnux, FLARE VM) making it a de facto index for the malware analysis community.
What it is
The rshipp/awesome-malware-analysis README is a link index with about 20 categories. Each entry is a tool name and a one-line description. It adds no tutorials, commands or version guidance. It is modelled on awesome-python and awesome-php, and a Chinese translation is linked.
What the summary leaves out
The list covers more than the summary names. Several categories matter when building a lab or triage workflow:
- Triage and identification: capa (detects capabilities in executables), YARA, Detect It Easy, TrID, ssdeep (fuzzy hashes), nsrllookup (NIST NSRL hash lookup), Assemblyline, MultiScanner and BinaryAlert (a serverless AWS pipeline that scans uploads against YARA rules).
- Deobfuscation: FLOSS (FireEye's obfuscated string solver), xortool, XORSearch, de4dot for .NET, uncompyle6 and PyInstaller Extractor for Python-built executables, and un{i}packer.
- Documents and scripts: olevba, peepdf, Didier Stevens' PDF Tools, box-js for JScript/WScript, libemu for shellcode emulation.
- Network lab: INetSim and FakeNet-NG to emulate services, and HTTPReplay for PCAPs with TLS master secrets.
- Memory: Volatility, Rekall, VolDiff (before/after execution diff) and FindAES.
- Lab images and malware-behaviour tests: FLARE VM (Windows), REMnux and Tsurugi (Linux), and Pafish and al-khaser, which test whether a sandbox is detectable the way malware detects it.
- Collaboration platforms: CRITs, FAME, Polichombr, stoQ, Viper, Aleph.
- Config extraction and training: DC3-MWCP for malware configuration parsing, and the RPISEC 2015 course materials and Practical Malware Analysis Starter Kit.
- Safe uploading: Recomposer is a helper script for safely uploading binaries to sandbox sites.
What to do
Use it as a lookup by task, then check each candidate yourself. The page gives access terms for only a few entries:
- VirusShare requires registration.
- Fidelis Barncat requires an access request.
- threatRECON allows up to 1000 free searches per month.
- cuckoo-modified is a GPL fork that the Cuckoo author did not merge upstream because of legal concerns.
Caveats
The page does not say which entries are maintained, so each link needs a liveness check before it goes into a pipeline. Descriptions are one line, with no comparison between overlapping tools (for example Cuckoo, DRAKVUF and Joe Sandbox, or IDA, Ghidra and Binary Ninja). Some entries are historical or renamed, such as Massive Octo Spice (formerly CIF) and RiskIQ (formerly PassiveTotal). Some trackers, such as ZeuS Tracker, are listed without a status note.
Technologies named here
- Windows
- Anonymouse.org
- OpenVPN
- Linux
- macOS
- Privoxy
- Tor
- Android
- Adobe Flash
- Conpot
- Cowrie
- PDF documents
- DemoHunter
- MS Office documents
- Dionaea
- Java applications
- PE files
- Glastopf
- firmware
- Honeyd
- HoneyDrive
- Honeytrap
- MHN
- Mnemosyne
- Thug
- Clean MX
- Contagio
- Exploit Database
- Infosec - CERT-PA
- InQuest Labs
- Javascript Mallware Collection
- Malpedia
- Malshare
- Ragpicker
- theZoo
- Tracker h3x
- vduddu malware repo
- VirusBay
- ViruSign
- VirusShare
- VX Vault
- VX Underground
- AbuseHelper
- AlienVault Open Threat Exchange
- Combine
- Fileintel
- Hostintel
- IntelMQ
- IOC Editor
- iocextract
- ioc_writer
- MalPipe
- Massive Octo Spice
- MISP
- Pulsedive
- PyIOCe
- RiskIQ
- threataggregator
- ThreatConnect
- ThreatCrowd
- ThreatIngestor
- ThreatTracker
- TIQ-test
- Autoshun
- Bambenek Consulting Feeds
- Fidelis Barncat
- CI Army
- Critical Stack Free Intel Market
- Cybercrime tracker
- FireEye IOCs
- FireHOL IP Lists
- HoneyDB
- hpfeeds
- InQuest REPdb
- InQuest IOCdb
- Internet Storm Center
- malc0de
- Malware Domain List
- MetaDefender Threat Intelligence Feed
- OpenIOC
- Proofpoint Threat Intelligence
- STIX
- SystemLookup
- ThreatMiner
- threatRECON
- ThreatShare
- YARA rules
- YETI
- ZeuS Tracker
- AnalyzePE
- Assemblyline
- BinaryAlert
- capa
- chkrootkit
- ClamAV
- Detect It Easy
- Exeinfo PE
- ExifTool
- File Scanning Framework
- fn2yara
- Generic File Parser
- hashdeep
- HashCheck
- Loki
- Malfunction
- Manalyze
- MASTIFF
- MultiScanner
- Nauz File Detector
- nsrllookup
- packerid
- PE-Bear
- PEframe
- PEV
- PortEx
- Quark Engine
- Rootkit Hunter
- ssdeep
- totalhash.py
- TrID
- YARA
- Yara rules generator
- Yara Finder
- anlyz.io
- ANY.RUN
- AndroTotal
- BoomBox
- Cryptam
- Cuckoo Sandbox
- cuckoo-modified
- cuckoo-modified-api
- DeepViz
- detux
- DRAKVUF
- filescan.io
- firmware.re
- HaboMalHunter
- Hybrid Analysis
- Intezer
- IRMA
- Joe Sandbox
- Jotti
- Limon
- Malheur
- malice.io
- malsub
- Malware config
- MalwareAnalyser.io
- Malwr
- MetaDefender Cloud
- NetworkTotal
- Noriben
- PacketTotal
- PDF Examiner
- ProcDot
- Recomposer
- sandboxapi
- SEE
- SEKOIA Dropper Analysis
- VirusTotal
- Visualize_Logs
- AbuseIPDB
- badips.com
- boomerang
- Cymon
- Desenmascara.me
- dig
- dnstwist
- IPinfo
- Machinae
- mailchecker
- MaltegoVT
- Multi rbl
- NormShield Services
- PhishStats
- Spyse
- SecurityTrails
- SpamCop
- Spamhaus
- Sucuri SiteCheck
- Talos Intelligence
- TekDefense Automater
- URLhaus
- URLQuery
- URLScan.io
- WHOIS
- ZScalar Zulu
- Bytecode Viewer
- Firebug
- Java Decompiler
- Java IDX Parser
- JSDetox
- jsunpack-n
- Krakatau
- Malzilla
- RABCDAsm
- SWF Investigator
- swftools
- xxxswf
- AnalyzePDF
- box-js
- diStorm
- InQuest Deep File Inspection
- JS Beautifier
- libemu
- malpdfobj
- OfficeMalScanner
- olevba
- Origami PDF
- PDF Tools
- PDF X-Ray Lite
- peepdf
- Quicksand
- Spidermonkey
- bulk_extractor
- EVTXtract
- Foremost
- hachoir3
- Scalpel
- SFlock
- Balbuzard
- de4dot
- ex_pe_xor & iheartxor
- FLOSS
- NoMoreXOR
- PackerAttacker
- PyInstaller Extractor
- uncompyle6
- un{i}packer
- unpacker
- unxor
- VirtualDeobfuscator
- XORBruteForcer
- XORSearch & XORStrings
- xortool
- Angr
- bamfdetect
- BAP
- BARF
- binnavi
- Binary Ninja
- Binwalk
- BluePill
- Capstone
- codebro
- Cutter
- DECAF
- dnSpy
- dotPeek
- Evan's Debugger
- Fibratus
- FPort
- GDB
- GEF
- Ghidra
- hackers-grep
- Hopper
- IDA Pro
- IDR
- Immunity Debugger
- ILSpy
- Kaitai Struct
- LIEF
- ltrace
- mac-a-mal
- objdump
- OllyDbg
- OllyDumpEx
- PANDA
- PEDA
- PEStudio
- Pharos
- plasma
- PPEE
- Process Explorer
- Process Hacker
- Process Monitor
- PSTools
- Pyew
- PyREBox
- Qiling Framework
- QKD
- radare2
- RegShot
- RetDec
- ROPMEMU
- Scylla Imports Reconstructor
- ScyllaHide
- SMRT
- strace
- StringSifter
- Triton
- Udis86
- Vivisect
- WinDbg
- x64dbg
- Bro
- BroYara
- CapTipper
- chopshop
- CloudShark
- FakeNet-NG
- Fiddler
- Hale
- Haka
- HTTPReplay
- INetSim
- Laika BOSS
- Malcolm
- Malcom
- Maltrail
- mitmproxy
- Moloch
- NetworkMiner
- ngrep
- PcapViz
- Python ICAP Yara
- Squidmagic
- tcpdump
- tcpick
- tcpxtract
- Wireshark
- Blacklight
- DAMM
- EVOLVE
- FindAES
- inVtero.net
- Muninn
- Orochi
- Rekall
- TotalRecall
- VolDiff
- Volatility
- VolUtility
- WDBGARK
- AChoir
- python-evt
- python-registry
- RegRipper
- Aleph
- CRITs
- FAME
- Malwarehouse
- Polichombr
- stoQ
- Viper
- al-khaser
- CryptoKnight
- DC3-MWCP
- FLARE-VM
- MalSploitBase
- Malware Museum
- Malware Organiser
- Pafish
- REMnux
- Tsurugi Linux
- Santoku Linux
- Ember
Techniques named here
- Malware sample collection and honeypot trapping
- IOC harvesting and threat intel aggregation
- Static analysis of executables/documents
- Dynamic/sandboxed analysis
- Domain/IP reputation and typosquatting detection
- Malicious script/document deobfuscation
- File carving from disk/memory images
- XOR and code obfuscation reversal
- Static and dynamic binary analysis / disassembly
- Network traffic analysis for malware C2 detection
- Memory forensics
- Anti-sandbox/anti-debug evasion detection
- Rootkit detection
- Malware unpacking/dumping
Threat actors named here
- Zeus trojan
Related in Malware & RE
huntress.comwriteupReverse Engineering the Six Stages of MacSync Stealer and RAT
huntress.comwriteupPost-DEF CON Phishing Uses Malicious Google Doc to Deliver Malware
huntress.comwriteupClickFix Removes Your Background but Leaves the Malware
