Malware Python Packages

ioc-fanger

Fang and defang indicators of compromise. You can test this project in a GUI here: http://ioc-fanger.hightower.space .

volatility3

Volatility 3.0 development

blocklist-aggregator

Domains blocklist aggregator - Create your own list from several sources.

apk-info

APK full-featured parser

blint

blint is a Binary Linter that checks the security properties and capabilities of your executables. It can also generate a Software Bill-of-Materials (SBOM) for supported binaries.

autoit-ripper

Extract AutoIt scripts embedded in PE binaries

wordfence

Wordfence malware and vulnerability scanner command line utility.

virustotal-python

A Python library to interact with the public VirusTotal v3 and v2 APIs.

die-python

Native Python3 bindings for @horsicq's Detect-It-Easy

malwaredb

MalwareDB: bookkeeping for malware, goodware, and unknown files with relationship discovery

debloat

A GUI and CLI tool for removing bloat from executables

pywhat

🐸 Identify anything. pyWhat easily lets you identify emails, IP addresses, and more. Feed it a .pcap file or some text and it'll tell you what it is! 🧙‍♀️

malwoverview

Malwoverview is a first response tool for threat hunting across VirusTotal, Hybrid Analysis, URLHaus, Polyswarm, Malshare, Alien Vault, Malpedia, Malware Bazaar, ThreatFox, Triage, IPInfo, Shodan, AbuseIPDB, GreyNoise, URLScan.io, Whois/RDAP, NIST, and VulnCheck. Supports LLM enrichment, IOC extraction, YARA scanning, and Android analysis.

yaralyzer

Visually inspect and force decode YARA and regex matches found in both binary and text data with colors. Lots of colors.

ts-deepscan

Repository scanner for the identification of effective licenses and copyright information.

intelmq

IntelMQ is a solution for IT security teams for collecting and processing security feeds using a message queuing protocol.

malwarebazaar

Python based CLI for MalwareBazaar

yara-mail

A Python package and command line utility for scanning emails with YARA rules

pyimpfuzzy

Fuzzy Hash calculated from import API of PE files

yarobot

YARA generator inspired by yarGen

anteater

Anteater - CI Validation Framework

malwi

malwi - AI Python Malware Scanner

opensquat

openSquat - Detection of domain squatting, typosquatting, IDN homograph attacks, and phishing threats

shai-hulud-detector

A CLI tool to detect potential Shai Hulud npm-worm compromises in GitHub users and organizations.