Malware Research Python Packages

ioc-fanger

Fang and defang indicators of compromise. You can test this project in a GUI here: http://ioc-fanger.hightower.space .

iocextract

Defanged Indicator of Compromise (IOC) Extractor.

ioc-finder

Simple, effective, and modular package for parsing observables (indicators of compromise (IOCs), network data, and other, security related information) from text. It uses grammars rather than regexes which makes it more readable, maintainable, and hackable. Explore our interactive documentation here: https://hightower.space/ioc-finder/

pyhidra

Pyhidra is a Python library that provides direct access to the Ghidra API within a native CPython interpreter using jpype.

apkid

Android Application Identifier for Packers, Protectors, Obfuscators and Oddities - PEiD for Android

karton-core

Distributed malware processing framework based on Python, Redis and S3.

malwaredb

MalwareDB: bookkeeping for malware, goodware, and unknown files with relationship discovery

die-python

Native Python3 bindings for @horsicq's Detect-It-Easy

pywhat

🐸 Identify anything. pyWhat easily lets you identify emails, IP addresses, and more. Feed it a .pcap file or some text and it'll tell you what it is! 🧙‍♀️

threatingestor

Extract and aggregate threat intelligence.

vt

VirusTotal Full api

karton-classifier

File type classifier for the Karton framework.

mwdb-core

Malware repository component for samples & static configuration with REST API interface.

reminder-detector

Implementation of the packing detection heuristic from the paper "Packed PE File Detection for Malware Forensics" of Han et al.

bintropy

Analysis tool for estimating the likelihood that a binary contains compressed or encrypted bytes

dumpulator

An easy-to-use library for emulating code in minidump files.

peid

Python implementation of the Packed Executable iDentifier (PEiD)

pypackerdetect

Packing detection tool for PE files

karton-config-extractor

Static configuration extractor for the Karton framework

malware-atlas

ATLAS - Malware Analysis Description

python-see

Sandboxed Execution Environment

karton-archive-extractor

Extractor of various archive formats for Karton framework

visualize-logs

A Python library and command line tools to provide interactive log visualization.

karton-dashboard

A small Flask application that allows for Karton task and queue introspection.