awesome-malware-analysis/README.md

149 lines
5.5 KiB
Markdown
Raw Normal View History

# Awesome Malware Analysis
A curated list of awesome malware analysis tools and resources. Inspired by
[awesome-python](https://github.com/vinta/awesome-python) and
[awesome-php](https://github.com/ziadoz/awesome-php).
- [Awesome Malware Analysis](#awesome-malware-analysis)
- [Malware Collection](#malware-collection)
- [Anonymizers](#anonymizers)
- [Honeypots](#honeypots)
- [Malware Corpora](#malware-corpora)
- [Detection and Classification](#detection-and-classification)
2015-05-09 04:35:17 +00:00
- [Online Scanners and Sandboxes](#online-scanners-and-sandboxes)
- [Domain Analysis](#domain-analysis)
2015-05-09 15:25:59 +00:00
- [Documents and Shellcode](#documents-and-shellcode)
2015-05-09 04:41:41 +00:00
- [Memory Forensics](#memory-forensics)
2015-05-09 04:31:31 +00:00
- [Miscellaneous](#miscellaneous)
- [Resources](#resources)
- [Books](#books)
- [Twitter](#twitter)
2015-05-09 03:51:11 +00:00
- [Other](#other)
- [Related Awesome Lists](#related-awesome-lists)
- [Contributing](#contributing)
---
## Malware Collection
### Anonymizers
*Web traffic anonymizers for analysts.*
2015-05-09 04:23:12 +00:00
* [Anonymouse.org](http://anonymouse.org/) - A free, web based anonymizer.
* [OpenVPN](https://openvpn.net/) - VPN software and hosting solutions.
* [Privoxy](http://www.privoxy.org/) - An open source proxy server with some
privacy features.
* [Tor](https://www.torproject.org/) - The Onion Router, for browsing the web
without leaving traces of the client IP.
2015-05-09 03:51:11 +00:00
### Honeypots
2015-05-09 04:24:53 +00:00
*Trap and collect your own samples.*
2015-05-09 03:51:11 +00:00
### Malware Corpora
2015-05-09 04:24:53 +00:00
*Malware samples collected for analysis.*
2015-05-09 15:17:07 +00:00
* [Clean MX](http://support.clean-mx.de/clean-mx/viruses.php) - Realtime
database of malware and malicious domains.
2015-05-09 03:51:11 +00:00
* [Contagio](http://contagiodump.blogspot.com/) - A collection of recent
malware samples and analyses.
* [Exploit Database](https://www.exploit-db.com/) - Exploit and shellcode
samples.
2015-05-09 15:17:07 +00:00
* [Zeltser's Sources](https://zeltser.com/malware-sample-sources/) - A list
of malware sample sources put together by Lenny Zeltser.
2015-05-09 03:51:11 +00:00
## Detection and Classification
*Antivirus and other malware identification tools*
2015-05-09 15:36:04 +00:00
* [AnalyzePE](https://github.com/hiddenillusion/AnalyzePE) - Wrapper for a
variety of tools for reporting on Windows PE files.
* [ClamAV](http://www.clamav.net/index.html) - Open source antivirus engine.
* [YARA](https://plusvic.github.io/yara/) - Pattern matching tool for
analysts.
2015-05-09 04:35:17 +00:00
## Online Scanners and Sandboxes
* [Cuckoo Sandbox](http://cuckoosandbox.org/) - Open source, self hosted
sandbox and automated analysis system.
2015-05-09 04:35:17 +00:00
* [Jotti]() - Free online multi-AV scanner.
* [Malwr]() - Free analysis with an online Cuckoo Sandbox instance.
2015-05-09 04:35:53 +00:00
* [VirusTotal](https://www.virustotal.com/) - Free online analysis of malware
samples and URLs
* [Zeltser's List](https://zeltser.com/automated-malware-analysis/) - Free
automated sandboxes and services, compiled by Lenny Zeltser.
2015-05-09 04:35:17 +00:00
2015-05-09 15:26:12 +00:00
## Domain Analysis
*Inspect domains and IP addresses.*
* [Dig](http://networking.ringofsaturn.com/) - Free online dig and other
network tools.
2015-05-09 15:36:04 +00:00
* [IPinfo](https://github.com/hiddenillusion/IPinfo) - Gather information
about an IP or domain by searching online resources.
2015-05-09 15:26:12 +00:00
* [Whois](http://whois.domaintools.com/) - DomainTools free online whois
search.
* [Zeltser's List](https://zeltser.com/lookup-malicious-websites/) - Free
online tools for researching malicious websites, compiled by Lenny Zeltser.
## Documents and Shellcode
2015-05-09 15:36:04 +00:00
* [AnalyzePDF](https://github.com/hiddenillusion/AnalyzePDF) - A tool for
analyzing PDFs and attempting to determine whether they are malicious.
2015-05-09 15:42:00 +00:00
* [JSDetox](http://www.relentless-coding.com/projects/jsdetox/) - JavaScript
malware analysis tool.
* [jsunpack-n](https://code.google.com/p/jsunpack-n/) - A javascript
unpacker that emulates browser functionality.
2015-05-09 15:46:37 +00:00
* [PDF Tools](http://blog.didierstevens.com/programs/pdf-tools/) - pdfid,
pdf-parser, and more from Didier Stevens.
* [Spidermonkey](https://developer.mozilla.org/en-US/docs/Mozilla/Projects/SpiderMonkey) -
Mozilla's JavaScript engine, for debugging malicious JS.
* [diStorm](http://www.ragestorm.net/distorm/) - Disassembler for analyzing
malicious shellcode.
2015-05-09 04:41:41 +00:00
## Memory Forensics
*Tools for dissecting malware in memory images or running systems.*
2015-05-09 04:41:41 +00:00
* [FindAES](https://jessekornblum.livejournal.com/269749.html) - Find AES
encryption keys in memory.
* [Rekall](http://www.rekall-forensic.com/) - Memory analysis framework,
forked from Volatility in 2013.
* [TotalRecall](https://github.com/sketchymoose/TotalRecall) - Script based
on Volatility for automating various malware analysis tasks.
* [Volatility](https://github.com/volatilityfoundation/volatility) - Advanced
memory forensics framework.
2015-05-09 04:42:55 +00:00
* [WinDbg](https://msdn.microsoft.com/en-us/windows/hardware/hh852365) - Live
memory inspection and kernel debugging for Windows systems.
2015-05-09 04:41:41 +00:00
2015-05-09 04:31:31 +00:00
## Miscellaneous
* [REMnux](https://remnux.org/) - Linux distribution and docker images for
malware reverse engineering and analysis.
2015-05-09 03:51:11 +00:00
# Resources
## Books
## Twitter
## Other
2015-05-09 15:17:07 +00:00
* [Malicious Software](https://zeltser.com/malicious-software/) - Malware
blog and resources by Lenny Zeltser.
* [/r/Malware](https://www.reddit.com/r/Malware) - The malware subreddit.
* [/r/ReverseEngineering](https://www.reddit.com/r/ReverseEngineering) -
Reverse engineering subreddit, not limited to just malware.
2015-05-09 03:51:11 +00:00
# Related Awesome Lists
* [Android Security](https://github.com/ashishb/android-security-awesome)
* [Pentesting](https://github.com/enaqx/awesome-pentest)
* [Security](https://github.com/sbilly/awesome-security)
# [Contributing](CONTRIBUTING.md)
Pull requests and issues with suggestions are welcome!