Malware Research Python Packages

ioc-fanger

Fang and defang indicators of compromise. You can test this project in a GUI here: http://ioc-fanger.hightower.space .

iocextract

Defanged Indicator of Compromise (IOC) Extractor.

ioc-finder

Simple, effective, and modular package for parsing observables (indicators of compromise (IOCs), network data, and other, security related information) from text. It uses grammars rather than regexes which makes it more readable, maintainable, and hackable. Explore our interactive documentation here: https://hightower.space/ioc-finder/

pyhidra

Pyhidra is a Python library that provides direct access to the Ghidra API within a native CPython interpreter using jpype.

apkid

Android Application Identifier for Packers, Protectors, Obfuscators and Oddities - PEiD for Android

karton-core

Distributed malware processing framework based on Python, Redis and S3.

peid

Python implementation of the Packed Executable iDentifier (PEiD)

malwaredb

MalwareDB: bookkeeping for malware, goodware, and unknown files with relationship discovery

die-python

Native Python3 bindings for @horsicq's Detect-It-Easy

pywhat

🐸 Identify anything. pyWhat easily lets you identify emails, IP addresses, and more. Feed it a .pcap file or some text and it'll tell you what it is! 🧙‍♀️

threatingestor

Extract and aggregate threat intelligence.

vt

VirusTotal Full api

mwdb-core

Malware repository component for samples & static configuration with REST API interface.

bintropy

Analysis tool for estimating the likelihood that a binary contains compressed or encrypted bytes

reminder-detector

Implementation of the packing detection heuristic from the paper "Packed PE File Detection for Malware Forensics" of Han et al.

pypackerdetect

Re-implementation and packaging of PyPackerDetect

karton-classifier

File type classifier for Karton framework

dumpulator

An easy-to-use library for emulating memory dumps. Useful for malware analysis (config extraction, unpacking) and dynamic analysis in general (sandboxing).

python-see

Sandboxed Execution Environment

malware-atlas

ATLAS - Malware Analysis Description

visualize-logs

A Python library and command line tools to provide interactive log visualization.

karton-archive-extractor

Extractor of various archive formats for Karton framework

cy-ioc-finder

Python package for finding and parsing indicators of compromise from text.

karton-config-extractor

Static configuration extractor for the Karton framework