Malware

Sandfly-Entropyscan – Tool To Detect Packed Or Encrypt ed Binaries Related To Malware, Finds Malicious Files And Linux Processes And Gives Output With Cryptographic Hashes

31 Jan 2023 By hackergadgets

What is sandfly-entropyscan? sandfly-entropyscan is a utility to quickly scan files or running processes and report on their entropy (measure of randomness) and if they are a Linux/Unix ELF type executable. Some malware for Linux is packed or encrypted and shows very high entropy. This tool can quickly find high entropy executable files and processesRead More

Subparse – Modular Malware Analysis Artifact Collection And Correlation Framework

02 Jan 2023 By hackergadgets

Subparse, is a modular framework developed by Josh Strochein, Aaron Baker, and Odin Bernstein. The framework is designed to parse and index malware files and present the information found during the parsing in a searchable web-viewer. The framework is modular, making use of a core parsing engine, parsing modules, and a variety of enrichers thatRead More

BeatRev – POC For Frustrating/Defeating Malware Analysts

04 Sep 2022 By hackergadgets

BeatRev Version 2 Disclaimer/Liability The work that follows is a POC to enable malware to “key” itself to a particular victim in order to frustrate efforts of malware analysts. I assume no responsibility for malicious use of any ideas or code contained within this project. I provide this research to further educate infosec professionals andRead More

System Informer – A Free, Powerful, Multi-Purpose Tool That Helps You Monitor System Resources, Debug Software And Detect Malware

23 Aug 2022 By hackergadgets

System Informer A free, powerful, multi-purpose tool that helps you monitor system resources, debug software and detect malware. Brought to you by Winsider Seminars & Solutions, Inc. Project Website – Project Downloads System requirements Windows 7 or higher, 32-bit or 64-bit. Features A detailed overview of system activity with highlighting. Graphs and statistics allow youRead More

Maldev-For-Dummies – A Workshop About Malware Development

29 Jul 2022 By hackergadgets

In the age of EDR, red team operators cannot get away with using pre-compiled payloads anymore. As such, malware development is becoming a vital skill for any operator. Getting started with maldev may seem daunting, but is actually very easy. This workshop will show you all you need to get started! This repository contains theRead More

Norimaci – Simple And Lightweight Malware Analysis Sandbox For macOS

24 Jun 2022 By hackergadgets

[*] “Norimaci” is a simple and lightweight malware analysis sandbox for macOS. This tool was inspired by “Noriben“. Norimaci uses the features of OpenBSM or Monitor.app to monitor macOS system activity instead of Sysinternals Process Monitor (procmon). Norimaci consists of 3 Python scripts. norimaci.py : Main script openbsmconv.py : OpenBSM audit log converter monitorappconv.py :Read More

DroidDetective – A Machine Learning Malware Analysis Framework For Android Apps

25 May 2022 By hackergadgets

A machine learning malware analysis framework for Android apps. DroidDetective is a Python tool for analysing Android applications (APKs) for potential malware related behaviour and configurations. When provided with a path to an application (APK file) Droid Detective will make a prediction (using it’s ML model) of if the application is malicious. Features and qualitiesRead More

Lupo – Malware IOC Extractor. Debugging Module For Malware Analysis Automation

29 Apr 2022 By hackergadgets

Debugging module for Malware Analysis Automation For a step by step post on how to use Lupo, with images and instructions, please see this post: https://medium.com/@vishal_thakur/lupo-malware-ioc-extractor-cc86ae76b85d Introduction Working on security incidents that involve malware, we come across situations on a regular basis where we feel the need to automate parts of the analysis process asRead More

CAPEv2 – Malware Configuration And Payload Extraction

02 Mar 2022 By hackergadgets

CAPE is a malware sandbox. It was derived from Cuckoo with the goal of adding automated malware unpacking and config extraction – hence its name is an acronym: ‘Config And Payload Extraction’. Automated unpacking allows classification based on Yara signatures to complement network (Suricata) and behavior (API) signatures. There is a free community instance onlineRead More

X