Top 23 Python malware-analysis Projects

• theZoo

  64 10,688 2.8 Python

  A repository of LIVE malwares for your own joy and pleasure. theZoo is a project created to make the possibility of malware analysis open and available to the public.

Project mention: TheZoo a.k.a. Malware DB | news.ycombinator.com | 2023-08-18

• pwndbg

  9 6,700 9.5 Python

  Exploit Development and Reverse Engineering with GDB Made Easy

  

• WorkOS

  workos.com sponsored

  The modern identity platform for B2B SaaS. The APIs are flexible and easy-to-use, supporting authentication, user identity, and complex enterprise features like SSO and SCIM provisioning.

  

• gef

  15 6,474 8.4 Python

  GEF (GDB Enhanced Features) - a modern experience for GDB with advanced debugging capabilities for exploit devs & reverse engineers on Linux

Project mention: Beej's Quick Guide to GDB (2009) | news.ycombinator.com | 2023-11-05

There is also GEF, which is widely used by the reverse engineering and CTF community.

https://github.com/hugsy/gef

• pyWhat

  16 6,352 0.0 Python

  🐸 Identify anything. pyWhat easily lets you identify emails, IP addresses, and more. Feed it a .pcap file or some text and it'll tell you what it is! 🧙‍♀️

• capa

  2 3,842 9.8 Python

  The FLARE team's open-source tool to identify capabilities in executable files.

  

Project mention: N00bs Night Malware RE Workshop with @c3rb3ru5d3d53c (OALABS) ​ | /r/Malware | 2023-06-11

Python3 Environment Basics For IDA Pro (Windows) https://www.patreon.com/posts/python3-basics-58467121 Hexcopy (save a click) https://github.com/OALabs/hexcopy-ida HashDB https://github.com/OALabs/hashdb-ida Flare-IDA https://github.com/mandiant/flare-ida Capa https://github.com/mandiant/capa Capa Rules https://github.com/mandiant/capa-rules BinDiff https://www.youtube.com/watch?v=BLBjcZe-C3I

• IntelOwl

  13 3,103 9.6 Python

  IntelOwl: manage your Threat Intelligence at scale

  

Project mention: Monthly Security Checklist | /r/msp | 2023-06-25

• flare-floss

  4 3,016 9.3 Python

  FLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.

  

• InfluxDB

  www.influxdata.com sponsored

  Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.

  

• oletools

  5 2,742 5.6 Python

  oletools - python tools to analyze MS OLE2 files (Structured Storage, Compound File Binary Format) and MS Office documents, for malware analysis, forensics and debugging.

• malwoverview

  3 2,725 6.7 Python

  Malwoverview is a first response tool used for threat hunting and offers intel information from Virus Total, Hybrid Analysis, URLHaus, Polyswarm, Malshare, Alien Vault, Malpedia, Malware Bazaar, ThreatFox, Triage, InQuest and it is able to scan Android devices against VT.

• flare-fakenet-ng

  2 1,689 0.0 Python

  FakeNet-NG - Next Generation Dynamic Network Analysis Tool

  

• CAPEv2

  5 1,650 9.9 Python

  Malware Configuration And Payload Extraction

• yarGen

  1 1,447 5.5 Python

  yarGen is a generator for YARA rules

• ViperMonkey

  1 1,021 0.0 Python

  A VBA parser and emulation engine to analyze malicious macros.

• malboxes

  1 1,011 1.8 Python

  Builds malware analysis Windows VMs so that you don't have to.

  

• drakvuf-sandbox

  2 983 8.4 Python

  DRAKVUF Sandbox - automated hypervisor-level malware analysis system

  

• unlicense

  2 874 6.3 Python

  Dynamic unpacker and import fixer for Themida/WinLicense 2.x and 3.x.

• antivmdetection

  1 686 0.0 Python

  Script to create templates to use with VirtualBox to make vm detection harder

• packj

  38 614 7.2 Python

  Packj stops :zap: Solarwinds-, ESLint-, and PyTorch-like attacks by flagging malicious/vulnerable open-source dependencies ("weak links") in your software supply-chain

  

Project mention: Rust Without Crates.io | news.ycombinator.com | 2023-11-14

Creator of Packj [1] here. How do you envision sandboxing/security policies will be specified? Per-lib policies when you've hundreds of dependencies will become overwhelming. Having built an eBPF-based sandbox [2], I anticipate that accuracy will be another challenge here: too restrictive will block functionality, too permissive defeats the purpose.

1. https://github.com/ossillate-inc/packj flags malicious/risky NPM/PyPI/RubyGems/Rust/Maven/PHP packages by carrying out static+dynamic+metadata analysis.

• refinery

  2 588 9.7 Python

  High Octane Triage Analysis (by binref)

  

• honeypots

  1 585 9.2 Python

  30 different honeypots in one package! (dhcp, dns, elastic, ftp, http proxy, https proxy, http, https, imap, ipp, irc, ldap, memcache, mssql, mysql, ntp, oracle, pjl, pop3, postgres, rdp, redis, sip, smb, smtp, snmp, socks5, ssh, telnet, vnc)

  

• karton

  2 366 7.0 Python

  Distributed malware processing framework based on Python, Redis and S3.

  

Project mention: Advices for an automated malware analysis lab project | /r/Malware | 2023-07-11

• IATelligence

  5 341 10.0 Python

  IATelligence is a Python script that will extract the IAT of a PE file and request GPT to get more information about the API and the ATT&CK matrix related

• mwdb-core

  1 292 8.5 Python

  Malware repository component for samples & static configuration with REST API interface.

  

Project mention: Advices for an automated malware analysis lab project | /r/Malware | 2023-07-11

• SaaSHub

  www.saashub.com sponsored

  SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives

  

Python malware-analysis related posts

• TheZoo a.k.a. Malware DB
  1 project | news.ycombinator.com | 18 Aug 2023
• Tools to demonstrate malware or ransomware infected PC
  1 project | /r/cybersecurity | 20 Jul 2023
• Advices for an automated malware analysis lab project
  3 projects | /r/Malware | 11 Jul 2023
• Worms for practice
  1 project | /r/hacking | 28 Jun 2023
• N00bs Night Malware RE Workshop with @c3rb3ru5d3d53c (OALABS) ​
  5 projects | /r/Malware | 11 Jun 2023
• Python script which uses Ghidra doesn't recognize imports
  1 project | /r/ghidra | 11 Jun 2023
• Diablo I/II/III/IV/Immortal Class Randomizer
  2 projects | /r/diablo4 | 19 May 2023
• A note from our sponsor - WorkOS
  workos.com | 25 Apr 2024

  The APIs are flexible and easy-to-use, supporting authentication, user identity, and complex enterprise features like SSO and SCIM provisioning. Learn more →

Index

Sponsored

SaaSHub - Software Alternatives and Reviews

SaaSHub helps you find the best software and product alternatives

www.saashub.com

Do not miss the trending Python projects with our weekly report!