THREATBYTES / Malware-Analysis-Report-Template

A standardised malware analysis report template with a JSON Schema and Markdown format mapped to MITRE ATT&CK. Validate, share and compare reports consistently. Part of ThreatBytes.

StevenBlack / hosts

🔒 Consolidating and extending hosts files from several well-curated sources. Optionally pick extensions for porn, social media, and other categories.

pwndbg / pwndbg

Exploit Development and Reverse Engineering with GDB & LLDB Made Easy

malwaredllc / byob

An open-source post-exploitation framework for students, researchers and developers.

stamparm / maltrail

Malicious traffic detection system

bee-san / pyWhat

🐸 Identify anything. pyWhat easily lets you identify emails, IP addresses, and more. Feed it a .pcap file or some text and it'll tell you what it is! 🧙‍♀️

mandiant / capa

The FLARE team's open-source tool to identify capabilities in executable files.

qilingframework / qiling

A True Instrumentable Binary Emulation Framework

intelowlproject / IntelOwl

IntelOwl: manage your Threat Intelligence at scale

volatilityfoundation / volatility3

Volatility 3.0 development

mandiant / flare-floss

FLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.

alexandreborges / malwoverview

Malwoverview is a first response tool for threat hunting across VirusTotal, Hybrid Analysis, URLHaus, Polyswarm, Malshare, Alien Vault, Malpedia, Malware Bazaar, ThreatFox, Triage, IPInfo, Shodan, AbuseIPDB, GreyNoise, URLScan.io, Whois/RDAP, NIST, and VulnCheck. Supports LLM enrichment, IOC extraction, YARA scanning, and Android analysis.

jekil / awesome-hacking

Awesome hacking is an awesome collection of hacking tools.

Cats-Team / AdRules

List for blocking ads in the Chinese region. Block Ads, Trackers, Malware, HTTPDNS, PCDN.

kevoreilly / CAPEv2

Malware Configuration And Payload Extraction

blackorbird / APT_REPORT

Interesting APT Report Collection And Some Special IOCs

mandiant / speakeasy

Windows kernel and user mode emulation.

ev-flow / quark-engine

—

CERT-Polska / drakvuf-sandbox

DRAKVUF Sandbox - automated hypervisor-level malware analysis system

2akouwu / reverify

Stop your AI from making things up — it proposes, deterministic tools decide, every claim checked against ground truth with evidence. Grounded facts and context survive resets. Reverse engineering is the proving ground. MCP server + CLI.

LING71671 / open-reverselab

Open-source AI reverse-engineering agent platform and MCP server for Ghidra, Frida, x64dbg and Rizin — automated PE/APK/binary analysis, CTF and malware research, with 100+ MCP tools and a 194-article runnable knowledge base.

morluto / awesome-reverse-engineering

Curated reverse-engineering tools and learning resources for binaries, apps, firmware, formats, and protocols.

Bert-JanP / Open-Source-Threat-Intel-Feeds

This repository contains Open Source freely usable Threat Intel feeds that can be used without additional requirements. Contains multiple types such as IP, URL, CVE and Hash.

certsocietegenerale / fame

FAME Automates Malware Evaluation

binref / refinery

High Octane Triage Analysis

dmdhrumilmistry / pyhtools

A Python Hacking Library consisting of network scanner, arp spoofer and detector, dns spoofer, code injector, packet sniffer, network jammer, email sender, downloader, wireless password harvester credential harvester, keylogger, download&execute, ransomware, data harvestors, etc.

MISP / misp-galaxy

Clusters and elements to attach to MISP events or attributes (like threat actors)

Azr43lKn1ght / DFIR-LABS

DFIR LABS - A compilation of challenges that aims to provide practice in simple to advanced concepts in the following topics: Digital Forensics, Incident Response, Malware Analysis and Threat Hunting.

hagezi / dns-servers

HaGeZi DNS: Free, Non-Commercial EU Public DNS Servers

fmhy / FMHYFilterlist

FMHY Filterlist

CybercentreCanada / assemblyline

Assemblyline 4: File triage and malware analysis

ImKKingshuk / LockKnife

LockKnife: The Ultimate Android Security Research Tool. A unified TUI workspace and headless CLI for deep Android security research, built for researchers and hackers. Powered by Python orchestration and a Rust-accelerated core, enabling AI agent–driven hacking, credential recovery/cracking, APK analysis, intelligence gathering, runtime inspection.

ADWMC / helm-d

DeepSeek Harness 破甲一体化安全分析插件：Android · Web · Native · Protocol · Malware · AI-Security 全领域聚合（9 bundle + 1 preset）

Ablation-Tool / ablation

Ablation is an autonomous reverse engineering system.

Whispergate / Labyrinth

Malware as a Service Ludus Range

dahan6 / whetstones-lab

Whetstones Lab: measuring coevolution between adaptive malware and behavioral defense. De-weaponized research release — genomes, evolution rounds, telemetry, training harness (stubbed primitives), and lab range tooling. Payloads, real primitives, and C2 infrastructure intentionally withheld. Research and defensive use only.

malwarejake / CUSTODY-framework

The CUSTODY(TM) Framework for AI Agent Containment

pverhoeven74 / Crypto-Clipper

Crypto Clipper is a cross-platform clipboard monitoring and builder tool for BTC, ETH, SOL, TRX, LTC, and DOGE address detection. Features include regex matching, address validation, activity logs, custom rules, clipboard history, UI customization, and standalone client generation for Windows, Linux, and macOS with embedded settings.

thatskriptkid / re-harness

Harness fo malware analysis

mohammad-alattas / APISignature

APISignature is a plugin for x64dbg that help the malware analysts & reverse engineers during analysis by adding a reference for more than 44,000+ API functions for Microsoft API documents & additional section about how to abuse the API function.

EmadAbedini / Dumplyzer

Open-source memory forensics platform for DFIR, threat hunting, malware analysis, and incident response.

yankywilson / kyber-ransomware-analysis

Full teardown of the Kyber ransomware Windows encryptor. Six corrections to public reporting, each independently verifiable. Includes analysis tooling, detection content, and incident response guidance.

prox0959 / CyberCodex

Autonomous 23-Source Zero-Cost OSINT, Binary Image Forensics (EXIF/GPS/Stego), Data Breach/Leak & Threat Intelligence Engine in Pure Python