Awesome

malware-analysis-scripts

Collection of scripts for different malware analysis tasks

Introduction

Some of these scripts are mine. Some of them are not. I have had many of these stored for a long time and I will try to make sure credit for others work is given where due, though sometimes I no longer know who the original author actually is.

If you happen to see code you recognize here please let me know in a Issue so I can assign proper credit.

This README will be used to keep track of the contents of this repo, what each script does and who the original authors are, if it is not myself. Each script may have it's own documentation within it as well.

Contents

Sorted by author:

• getstatic.py (deadbits)
• getimps.py (deadbits)
• domain_registrant.py (deadbits)
• gozi-c2-craft.py (deadbits)
• malshare_dl.py (deadbits)
• http_forge.py (deadbits)
• irc_stealth.py (deadbits)
• local2splunk.py (deadbits)
• lookup_dns.py (deadbits)
• mass_nmap.py (deadbits)
• maz_slim.py (deadbits)

• memdump.c (travis montoya)

• blackenergy.py (Malware.lu)
• bozok_config.py (Malware.lu)

• vt-notify.rb (author unknown)
• binextract.py (author unknown)
• anubis.py (author unknown)
• decodebhek.py (author unknown)
• cifcsv.py (author unknown)
• magic.py (author unknown)
• match.py (author unknown)
• phpdecode.py (author unknown)
• xorencode.c (author unkown - maybe myself? really dont remember..)
• xortools.py (author unknown)
• fake_dns.py (author unknown)

• darkcomet_config.py (r3shl4k1sh)

• atrax-root.py (siph0n)

• pescanner.py (Michael Ligh)
• avsubmit.py (Michael Ligh)
• db-artifacts.py (Michael Ligh)

• backtrack.py (Alexander Hanel)
• import_snapshop.py (Alexander Hanel)
• vt_pyscan.py (Alexander Hanel)

• AnalyzePE.py (hiddenillusion)
• IPInfo.py (hiddenillusion)

• Automater.py (TekDefesene)

• wepewet.py (wepawet@cs.ucsb.edu)