Awesome Malware Analysis

A curated list of awesome malware analysis tools and resources. Inspired by awesome-python and awesome-php.

Malware Collection

Web traffic anonymizers for analysts.

Anonymouse.org - A free, web based anonymizer.
OpenVPN - VPN software and hosting solutions.
Privoxy - An open source proxy server with some privacy features.
Tor - The Onion Router, for browsing the web without leaving traces of the client IP.

Trap and collect your own samples.

Conpot - ICS/SCADA honeypot.
Cowrie - SSH honeypot, based on Kippo.
DemoHunter - Low interaction Distributed Honeypots.
Dionaea - Honeypot designed to trap malware.
Glastopf - Web application honeypot.
Honeyd - Create a virtual honeynet.
HoneyDrive - Honeypot bundle Linux distro.
Honeytrap - Opensource system for running, monitoring and managing honeypots.
MHN - MHN is a centralized server for management and data collection of honeypots. MHN allows you to deploy sensors quickly and to collect data immediately, viewable from a neat web interface.
Mnemosyne - A normalizer for honeypot data; supports Dionaea.
Thug - Low interaction honeyclient, for investigating malicious websites.

Malware samples collected for analysis.

Clean MX - Realtime database of malware and malicious domains.
Contagio - A collection of recent malware samples and analyses.
Exploit Database - Exploit and shellcode samples.
Infosec - CERT-PA - Malware samples collection and analysis.
InQuest Labs - Evergrowing searchable corpus of malicious Microsoft documents.
Javascript Mallware Collection - Collection of almost 40.000 javascript malware samples
Malpedia - A resource providing rapid identification and actionable context for malware investigations.
Malshare - Large repository of malware actively scrapped from malicious sites.
Ragpicker - Plugin based malware crawler with pre-analysis and reporting functionalities
theZoo - Live malware samples for analysts.
Tracker h3x - Agregator for malware corpus tracker and malicious download sites.
vduddu malware repo - Collection of various malware files and source code.
VirusBay - Community-Based malware repository and social network.
ViruSign - Malware database that detected by many anti malware programs except ClamAV.
VirusShare - Malware repository, registration required.
VX Vault - Active collection of malware samples.
Zeltser's Sources - A list of malware sample sources put together by Lenny Zeltser.

Harvest and analyze IOCs.

AbuseHelper - An open-source framework for receiving and redistributing abuse feeds and threat intel.
AlienVault Open Threat Exchange - Share and collaborate in developing Threat Intelligence.
Combine - Tool to gather Threat Intelligence indicators from publicly available sources.
Fileintel - Pull intelligence per file hash.
Hostintel - Pull intelligence per host.
IntelMQ - A tool for CERTs for processing incident data using a message queue.
IOC Editor - A free editor for XML IOC files.
iocextract - Advanced Indicator of Compromise (IOC) extractor, Python library and command-line tool.
ioc_writer - Python library for working with OpenIOC objects, from Mandiant.
MalPipe - Malware/IOC ingestion and processing engine, that enriches collected data.
Massive Octo Spice - Previously known as CIF (Collective Intelligence Framework). Aggregates IOCs from various lists. Curated by the CSIRT Gadgets Foundation.
MISP - Malware Information Sharing Platform curated by The MISP Project.
Pulsedive - Free, community-driven threat intelligence platform collecting IOCs from open-source feeds.
PyIOCe - A Python OpenIOC editor.
RiskIQ - Research, connect, tag and share IPs and domains. (Was PassiveTotal.)

Threat intelligence and IOC resources.

Autoshun (list) - Snort plugin and blocklist.
Bambenek Consulting Feeds - OSINT feeds based on malicious DGA algorithms.
Fidelis Barncat - Extensive malware config database (must request access).
CI Army (list) - Network security blocklists.
Critical Stack- Free Intel Market - Free intel aggregator with deduplication featuring 90+ feeds and over 1.2M indicators.
Cybercrime tracker - Multiple botnet active tracker.
FireEye IOCs - Indicators of Compromise shared publicly by FireEye.
FireHOL IP Lists - Analytics for 350+ IP lists with a focus on attacks, malware and abuse. Evolution, Changes History, Country Maps, Age of IPs listed, Retention Policy, Overlaps.
HoneyDB - Community driven honeypot sensor data collection and aggregation.
hpfeeds - Honeypot feed protocol.
Infosec - CERT-PA lists (IPs - Domains - URLs) - Blocklist service.
InQuest REPdb - Continuous aggregation of IOCs from a variety of open reputation sources.
InQuest IOCdb - Continuous aggregation of IOCs from a variety of blogs, Github repos, and Twitter.
Internet Storm Center (DShield) - Diary and searchable incident database, with a web . ().