Malware Python Packages

ioc-fanger

Fang and defang indicators of compromise. You can test this project in a GUI here: http://ioc-fanger.hightower.space .

volatility3

Volatility 3.0 development

blocklist-aggregator

Domains blocklist aggregator - Create your own list from several sources.

apk-info

APK full-featured parser

blint

blint is a Binary Linter that checks the security properties and capabilities of your executables. It can also generate a Software Bill-of-Materials (SBOM) for supported binaries.

virustotal-python

A Python library to interact with the public VirusTotal v3 and v2 APIs.

wordfence

Wordfence malware and vulnerability scanner command line utility.

malwaredb

MalwareDB: bookkeeping for malware, goodware, and unknown files with relationship discovery

autoit-ripper

Extract AutoIt scripts embedded in PE binaries

malwoverview

Malwoverview is a first response tool for threat hunting across VirusTotal, Hybrid Analysis, URLHaus, Polyswarm, Malshare, Alien Vault, Malpedia, Malware Bazaar, ThreatFox, Triage, IPInfo, Shodan, AbuseIPDB, GreyNoise, URLScan.io, Whois/RDAP, NIST, and VulnCheck. Supports LLM enrichment, IOC extraction, YARA scanning, and Android analysis.

die-python

Native Python3 bindings for @horsicq's Detect-It-Easy

debloat

A GUI and CLI tool for removing bloat from executables

pywhat

🐸 Identify anything. pyWhat easily lets you identify emails, IP addresses, and more. Feed it a .pcap file or some text and it'll tell you what it is! 🧙‍♀️

intelmq

IntelMQ is a solution for IT security teams for collecting and processing security feeds using a message queuing protocol.

yaralyzer

Visually inspect and force decode YARA and regex matches found in both binary and text data with colors. Lots of colors.

malwarebazaar

Python based CLI for MalwareBazaar

ts-deepscan

Repository scanner for identification of licenses, copyrights and encryption

yarobot

Simple YARA rules generator with web interface, API, and cli

malwi

malwi - AI Python Malware Scanner

pyimpfuzzy

Fuzzy Hash calculated from import API of PE files

iocparser-tool

IOCParser extracts Indicators of Compromise from reports, feeds, URLs, stdin, and directory trees. It supports refanging, MISP warning-list enrichment, structured renderers, persisted run history, IOC search, run diffs, and queue-backed distributed processing.

wifiphisher

The Rogue Access Point Framework

yara-mail

A Python package and command line utility for scanning emails with YARA rules

dumpulator

An easy-to-use library for emulating memory dumps. Useful for malware analysis (config extraction, unpacking) and dynamic analysis in general (sandboxing).