Tools

An interactive online malware sandbox — unlike a fully automated sandbox, an analyst can click through the running VM in real time (dismiss a dialog, wait out a sleep timer) to get past evasion that defeats hands-off detonation.

Fingerprints an APK's toolchain, compiler and packer/obfuscator (PEiD for Android) — quickly flags whether a sample was built with a known obfuscation or packing tool.

apkid app.apk

CLI toolkit of chainable "units" (like a Unix pipeline) for deobfuscating and unpacking malware — base64/XOR decode, carve, decompress and extract config data in one piped command.

emit sample.bin | carve -f b64 | b64 | xor 0x41 | peek

Identifies capabilities in an executable — "reads the clipboard", "installs a service", "encrypts files" — by matching disassembly and API-call patterns, so an analyst gets a functional summary before doing manual reverse engineering.

capa malware.exe

An automated malware analysis sandbox descended from Cuckoo, focused on Configuration And Payload Extraction — it unpacks and extracts C2 configs from common malware families rather than just logging behaviour.

Config And Payload Extraction — a Cuckoo fork focused on automatically unpacking malware and dumping the decrypted C2 configuration of hundreds of known families.

Explores malicious HTTP traffic captured in a pcap — replays the conversation, reconstructs redirect chains and lets you pull out the delivered payload for analysis.

python captipper.py malicious.pcap

PE editor and viewer for manually inspecting and patching Windows executable headers, sections, imports and resources — a staple of PE-format malware triage.

/etc/ld.so.preload is loaded into every dynamically linked binary on the system, a favourite location for rootkit persistence.

cat /etc/ld.so.preload 2>/dev/null
ls -la /etc/ld.so.preload

Quick manual triage step before uploading a sample anywhere — hash it locally and grep against a downloaded IOC list (e.g. exported from MISP/ThreatFox) offline.

sha256sum suspicious.bin | tee /dev/stderr | cut -d' ' -f1 | grep -Ff known_bad_hashes.txt && echo MATCH

TheHive project's observable-analysis engine — runs analyzers (VirusTotal, abuse.ch, MISP, sandbox lookups, etc.) against IOCs on demand or from a case.

The original open-source automated malware analysis sandbox — detonates a sample in an instrumented VM and reports API calls, network traffic, dropped files and screenshots.

cuckoo submit suspicious.exe

Signature-based packer, compiler and file-type identifier for PE/ELF/Mach-O binaries — the modern, actively maintained successor to PEiD for "what packed this".

diec ./sample.exe

A honeypot built to be exploited — emulates vulnerable network services (SMB, HTTP, FTP, MSSQL and more) specifically to capture the malware payloads that automated worms and bots drop when they try to exploit it.

Community-maintained continuation of dnSpy — a .NET assembly editor, debugger and decompiler, the standard tool for analysing .NET malware and unpacking .NET loaders.

Agentless dynamic malware analysis system built on Xen VMI — observes a sample from outside the guest, so it leaves no in-guest artifacts for anti-analysis code to detect.

An unfamiliar or unsigned module in the list is one of the more reliable signs of a kernel-level rootkit.

lsmod | sort

Lightweight PE packer/compiler signature scanner with built-in unpacker scripts for common packers — a quick first pass before deeper static analysis.

Pulls every IPv4 address and FQDN-looking string out of an arbitrary text blob (a vendor report, a phishing email, a log dump) for quick pivoting into a threat-intel lookup.

grep -oE '([0-9]{1,3}\.){3}[0-9]{1,3}' report.txt | sort -u
grep -oE '\b[a-z0-9.-]+\.[a-z]{2,}\b' report.txt | sort -u

Mandiant's next-gen network simulation tool for dynamic malware analysis — intercepts and fakes DNS/HTTP/HTTPS/SSL traffic on the analysis host itself, no separate VM needed.

fakenet.exe

A dependency-free bash IOC scanner in the same family as Loki — checks hashes, filenames, string matches and suspicious permissions against a simple indicator list, for hosts where nothing heavier can be installed.

./fenrir.sh /path/to/scan

abuse.ch's tracker for Emotet/Dridex/QakBot/TrickBot-family botnet C2 servers — publishes a live blocklist of active C2 IPs.

Mandiant's tool for extracting obfuscated/encoded strings from a binary by emulating the routines that decode them at runtime — surfaces strings plain `strings` cannot see.

floss ./chall

Mandiant's Windows counterpart to REMnux — a scripted install of a full reverse-engineering and malware-analysis toolchain onto a fresh Windows VM, for analysing Windows malware in its native environment.

FireEye Labs Obfuscated String Solver — automatically extracts stack strings, decoded strings and tight-loop-obfuscated strings that plain `strings` misses in packed/obfuscated malware.

floss malware.exe -o strings.txt

Mandiant's successor to plain `strings` for malware triage — statically emulates a binary just enough to decode stack strings, obfuscated strings and strings built at runtime that a normal string dump never reveals.

floss malware.exe

Runs PE-sieve across every running process on a system in one pass, flagging and dumping any that show signs of process hollowing or code injection — a whole-host sweep rather than a single-process check.

hollows_hunter64.exe

CrowdStrike's free public malware sandbox (Falcon Sandbox front end) — submit a sample or hash and get a detailed static/dynamic report, MITRE ATT&CK mapping included.

Simulates common internet services (HTTP, DNS, SMTP, FTP…) so malware detonated in an isolated lab thinks it has internet access — captures every request it makes.

inetsim --data-dir /var/lib/inetsim/data

A threat-intel aggregation platform that fans a single observable (hash, IP, domain, URL) out to dozens of analyzers — VirusTotal, AbuseIPDB, YARA, sandboxes — and returns one combined report instead of querying each by hand.

Malware analysis platform built around code-reuse/genetic similarity — classifies a sample by comparing its compiled code fragments against known malware and software libraries.

Deep-analysis malware sandbox with a free cloud-basic tier — hybrid static/dynamic/hypervisor-based analysis with especially detailed behaviour and evasion detection signals.

CERT.pl's distributed malware analysis pipeline framework — chains classifiers, unpackers and config extractors as independent workers around a shared task queue.

A process running from memory with a deleted or missing on-disk image is a strong process-injection/hollowing indicator — this osquery pulls exactly that condition.

osqueryi "SELECT pid, name, path, cmdline FROM processes WHERE on_disk = 0;"

Florian Roth's free IOC and YARA scanner — walks a filesystem checking file hashes, filenames, YARA signatures and known-bad registry/process indicators against a curated ruleset, for a quick compromise check on a single host.

python loki.py -p C:\

Catalogue of known vulnerable and malicious signed Windows kernel drivers (the "bring your own vulnerable driver" list) used for EDR-killing and kernel-level attacks.

Hex-editor-meets-static-analyzer built for malware and CTF work — combines hex view, disassembly, string extraction, entropy visualisation and YARA scanning in one IDE-like window.

CERT.pl's Python library for malware config extraction and crypto/decoding primitives — the extraction engine behind mwdb/Karton pipelines for many malware families.

abuse.ch project sharing malware samples and hashes submitted by the community, with free API access for hash lookups and bulk sample downloads for research.

Static PE analysis tool aimed at malware triage — plugin architecture scores suspicious imports, packing, resources and sections and can run YARA rules over the binary.

manalyze --dump=all suspicious.exe

Open-source threat intelligence platform — stores, correlates and shares IOCs and events between organisations via a structured, taxonomy-tagged data model.

A memory-anomaly scanner for detecting malware implants that leave no trace on disk — walks a process's virtual memory looking for the permission/backing-file inconsistencies that in-memory injection techniques produce.

Moneta64.exe -p 1234

CERT.pl's Malware Database — a sample repository and analysis pipeline hub that stores samples, configs and relations, feeding automated processing via Karton.

A Python wrapper around Sysinternals Procmon that auto-generates a concise, readable malware behaviour report — file, registry, network and process activity — from one run.

python Noriben.py

GUI PE file analyzer for inspecting and editing headers, sections, imports and resources of Windows executables — a staple for manual PE malware/CTF triage.

hasherezade's scanner for detecting and dumping malicious implants (process hollowing, reflective DLL injection, shellcode) from a single running Windows process, recovering an unpacked copy for analysis.

pe-sieve64.exe /pid 1234

Open-source Python tool for static malware analysis of PE files — extracts strings, imports, indicators of packing and generic obfuscation with a simple CLI report.

peframe suspicious.exe

Static PE-file triage tool that surfaces imports, strings, resources and known-bad indicators in a suspicious Windows executable up front — designed specifically to be run without ever executing the sample.

Sysinternals tool logging real-time file system, registry and process/thread activity — the standard way to see exactly what a suspicious process is doing on a live Windows host.

procmon.exe /BackingFile trace.pml /Quiet /Minimized

Higher-level binary emulation framework built on Unicorn that emulates whole userspace programs (Linux/Windows/macOS/firmware) including syscalls, letting you run a target off its own OS.

qltool run -f ./sample --rootfs ./rootfs

Android malware-scoring engine that matches API call sequences against a rule set to produce a "how malicious does this behave" score, rather than just a static signature match.

quark -a app.apk -s

Shows the quarantine extended attribute macOS stamps on anything downloaded from the internet — useful for both malware triage and testing your own tooling's execution path.

xattr -l suspicious_file

Takes a registry+filesystem snapshot before and after running a sample and diffs them — the quickest way to see exactly what a piece of malware changed on disk/registry.

Lenny Zeltser's curated Linux distribution for malware analysis — pre-installs the FLARE/community toolchain (FLOSS, Capa, YARA tooling, network fakers, deobfuscators) so an analyst is not assembling one tool at a time.

Active Countermeasures' open-source beaconing-detection tool — analyses Zeek logs for the regular-interval connection patterns that C2 beacons produce, surfacing them without needing signatures for the malware itself.

rita import /opt/zeek/logs/current mydataset

Neo23x0's public collection of YARA rules and IOCs used by Loki/THOR — a solid, actively maintained rule set to drop straight into your own scanner or SIEM.

Mandiant's Windows binary emulator for malware analysis — runs a sample's code against an emulated Windows API surface to observe its behaviour (registry, network, file activity) without a full sandbox VM or real execution.

speakeasy -t malware.exe -o report.json

Ranks host pairs by connection count as a quick, RITA-free first pass at spotting regular-interval C2 beaconing in Zeek connection logs.

zcat conn.log.gz | zeek-cut id.orig_h id.resp_h duration | sort | uniq -c | sort -rn | head

Fuzzy (context-triggered piecewise) hashing tool for measuring similarity between files rather than exact equality — used to cluster near-identical malware samples or CTF file variants.

ssdeep -r samples/

abuse.ch's SSL Blacklist — JA3/JA3s and certificate SHA1 fingerprints associated with malware C2, useful for detecting malicious TLS traffic without decrypting it.

Curated repository of live malware samples for research and defence testing — clearly labelled and deliberately hard to run by accident.

Nextron Systems' free edition of their commercial THOR APT scanner — a faster, more actively maintained successor to Loki, built to sweep a host for the same class of compromise indicators and YARA hits.

abuse.ch platform for sharing indicators of compromise (IOCs) — malicious IPs, domains and URLs tied to specific malware families, free to query via API.

Trend Micro's locality-sensitive fuzzy hash, an alternative to ssdeep with better resistance to certain evasion tricks, used for file/malware similarity matching.

Hatching's automated malware sandbox — detonates a submitted sample across multiple Windows/Linux/Android profiles and returns behavioural reports, extracted configs and IOCs, with a free tier for public submissions.

abuse.ch project tracking URLs actively distributing malware, with a searchable database and downloadable blocklists for defensive use.

Multi-engine file/URL/domain/IP reputation lookup aggregating dozens of AV engines and sandboxes — the standard first stop for triaging a suspicious sample or link.

Large public archive of malware samples, source code leaks and research papers — the go-to reference library for malware researchers looking up a family or campaign.

A pattern-matching engine purpose-built for malware research — write rules describing families of malicious files, then scan a filesystem or memory image against them at speed.

yara rules.yar suspicious_file

VirusTotal's ground-up Rust rewrite of the YARA scanning engine — a drop-in-compatible, faster and memory-safer replacement for the original C implementation, maintained by the same team.

yr scan rules.yar sample.bin

Generates YARA rules from a set of malware samples, using string frequency scoring against a large goodware corpus to avoid noisy, false-positive-prone signatures.

python3 yarGen.py -m /malware_samples/ -o generated.yar