THREATBYTES / Malware-Analysis-Report-Template

A standardised malware analysis report template with a JSON Schema and Markdown format mapped to MITRE ATT&CK. Validate, share and compare reports consistently. Part of ThreatBytes.

pwndbg / pwndbg

Exploit Development and Reverse Engineering with GDB & LLDB Made Easy

bee-san / pyWhat

🐸 Identify anything. pyWhat easily lets you identify emails, IP addresses, and more. Feed it a .pcap file or some text and it'll tell you what it is! 🧙‍♀️

mandiant / capa

The FLARE team's open-source tool to identify capabilities in executable files.

intelowlproject / IntelOwl

IntelOwl: manage your Threat Intelligence at scale

mandiant / flare-floss

FLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.

alexandreborges / malwoverview

Malwoverview is a first response tool for threat hunting across VirusTotal, Hybrid Analysis, URLHaus, Polyswarm, Malshare, Alien Vault, Malpedia, Malware Bazaar, ThreatFox, Triage, IPInfo, Shodan, AbuseIPDB, GreyNoise, URLScan.io, Whois/RDAP, NIST, and VulnCheck. Supports LLM enrichment, IOC extraction, YARA scanning, and Android analysis.

kevoreilly / CAPEv2

Malware Configuration And Payload Extraction

mandiant / speakeasy

Windows kernel and user mode emulation.

ev-flow / quark-engine

—

CERT-Polska / drakvuf-sandbox

DRAKVUF Sandbox - automated hypervisor-level malware analysis system

2akouwu / reverify

Stop your AI from making things up — it proposes, deterministic tools decide, every claim checked against ground truth with evidence. Grounded facts and context survive resets. Reverse engineering is the proving ground. MCP server + CLI.

LING71671 / open-reverselab

Open-source AI reverse-engineering agent platform and MCP server for Ghidra, Frida, x64dbg and Rizin — automated PE/APK/binary analysis, CTF and malware research, with 100+ MCP tools and a 194-article runnable knowledge base.

morluto / awesome-reverse-engineering

Curated reverse-engineering tools and learning resources for binaries, apps, firmware, formats, and protocols.

certsocietegenerale / fame

FAME Automates Malware Evaluation

binref / refinery

High Octane Triage Analysis

CybercentreCanada / assemblyline

Assemblyline 4: File triage and malware analysis

ImKKingshuk / LockKnife

LockKnife: The Ultimate Android Security Research Tool. A unified TUI workspace and headless CLI for deep Android security research, built for researchers and hackers. Powered by Python orchestration and a Rust-accelerated core, enabling AI agent–driven hacking, credential recovery/cracking, APK analysis, intelligence gathering, runtime inspection.

Ablation-Tool / ablation

Ablation is an autonomous reverse engineering system.

yankywilson / kyber-ransomware-analysis

Full teardown of the Kyber ransomware Windows encryptor. Six corrections to public reporting, each independently verifiable. Includes analysis tooling, detection content, and incident response guidance.

prox0959 / CyberCodex

Autonomous 23-Source Zero-Cost OSINT, Binary Image Forensics (EXIF/GPS/Stego), Data Breach/Leak & Threat Intelligence Engine in Pure Python