Malware Research Python Packages

ioc-fanger

Fang and defang indicators of compromise. You can test this project in a GUI here: http://ioc-fanger.hightower.space .

pyhidra

Pyhidra is a Python library that provides direct access to the Ghidra API within a native CPython interpreter using jpype.

iocextract

Defanged Indicator of Compromise (IOC) Extractor.

ioc-finder

Simple, effective, and modular package for parsing observables (indicators of compromise (IOCs), network data, and other, security related information) from text. It uses grammars rather than regexes which makes it more readable, maintainable, and hackable. Explore our interactive documentation here: https://hightower.space/ioc-finder/

apkid

Android Application Identifier for Packers, Protectors, Obfuscators and Oddities - PEiD for Android

karton-core

Distributed malware processing framework based on Python, Redis and S3.

malwaredb

MalwareDB: bookkeeping for malware, goodware, and unknown files with relationship discovery

vt

VirusTotal Full api

die-python

Native Python3 bindings for @horsicq's Detect-It-Easy

pywhat

🐸 Identify anything. pyWhat easily lets you identify emails, IP addresses, and more. Feed it a .pcap file or some text and it'll tell you what it is! 🧙‍♀️

threatingestor

Extract and aggregate threat intelligence.

1200km-aidebug

Evidence-focused malware reverse engineering with deep PE/.NET inspection, Ghidra reconstruction, AI cross-checks, YARA, and ELF debugging

bintropy

Analysis tool for estimating the likelihood that a binary contains compressed or encrypted bytes

peid

Python implementation of the Packed Executable iDentifier (PEiD)

dumpulator

An easy-to-use library for emulating memory dumps. Useful for malware analysis (config extraction, unpacking) and dynamic analysis in general (sandboxing).

mwdb-core

Malware repository component for samples & static configuration with REST API interface.

malware-atlas

ATLAS - Malware Analysis Description

python-see

Sandboxed Execution Environment

karton-config-extractor

Static configuration extractor for the Karton framework

pypackerdetect

Packing detection tool for PE files

karton-archive-extractor

Extractor of various archive formats for Karton framework

karton-classifier

File type classifier for the Karton framework.

reminder-detector

Implementation of the packing detection heuristic from the paper "Packed PE File Detection for Malware Forensics" of Han et al.

karton-dashboard

A small Flask application that allows for Karton task and queue introspection.