malware-gems - A not so awesome list of malware gems for aspiring

项目说明

malware-gems

NOTE: WORK IN PROGRESS! (Updated 19 July 2022)

What's this all about?

This page contains a list of mostly malware analysis / reverse engineering related tools, training, podcasts, blog posts, literature and just about anything else closely related to the topic. This page serves as a catalog of sorts, containing "gems", some of which you may ha across, and many others that you may not have.

Who is this page aimed at?

#### Myself:
When first starting out, I was o by how malware/RE related material was somewhat scattered all over the Internet. With a limited a of books and training, I started to collect my go-to sites for certain resources and tools in order to achi tasks.

#### Beginners:
I often get asked "how do you get started in malware analysis / RE". I'm hoping this list will provide a starting point at least. Anyone who has been practicing malware analysis for even a small amount of time, knows that there really is no single resource or location that will simply teach the art of malware analysis / RE. Plain and simple. That said, having a useful list of links is at least a starting point. However, one caveat is that this list should NOT replace your OWN time spent researching and learning by yourself. This is very much part of "the journey" towards becomming a better malware analyst / RE, similar to that of becomming a l33t h4x0r! ;)

#### Anyone else:
Regardless of skill/experience level, even the more experienced malware analyst / RE may hopefully find one or two useful gems on this page that they haven't yet stumbled across. This is where the name "malware-gems" originated from... Original, I know.. ;)

Isn't this similar to other "awesome" lists that exist on Github?

Perhaps. While the awesome "awesome" lists (as awesome as they are) gave me inspiration, I wanted to centralise my own tools/links etc due to growing my own malware analysis skills, in the hope that once I ha in one page, things may hopefully become a bit clearer in my head! In some ways, as awesome as the other "awesome" lists are, I hope that this list will in itself be just as awesome, due to the fact that the this reflects a true and current representation of a malware analyst such as myself, who is building up their own knowledge with acti to tools, reading material etc!

Anything else?

If you have any feedback or would like your site listed, feel free to reach out .
Twitter handle: 0x4143

###### Disclaimer:
* Full credits/props/respect to all the respecti for their content.
* I suspect that this list may morph gradually over time to possibly include other infosec related tools/links that aren't directly related to malware or RE, but I will try my very best to stay on topic! =)
* The links contained in each section are currently in no particular order.
* I may clean up the order at some point e.g. alphabetize, or order by preference.
* Some tools/links may likely be in the wrong category, I will review this as time goes on.
* This is a work-in-progress so bare with me!
* Sharing is caring, so feel free to forward this link around.
* "Haters gonna hate"!
* And last but not least, **enjoy! =)

Books:

* Intelligence Dri Response -
* Practical Malware Analysis -
* Re: Secrets of Reverse Engineering -
* Practical Reverse Engineering -
* Malware Analyst Cookbook -
* IDA Pro Book -
* Art of Assembly -
* The Art of Memory Forensics -
* Windows Internals, Part 1 (6th Edition) -
* Windows Internals, Part 2 (6th Edition) -
* Windows Internals, Part 1 (7th Edition):

* Windows Internals, Part 2 (7th Edition):

* Hacking. The Art of Exploitation -
* The Shellcoder's Handbook: Disco and Exploiting Security Holes -
* Rootkits: Sub the Windows Kernel -
* Rootkits and Bootkits -
* The Cuckoo's Egg: Tracking a Spy Through the Maze of Computer Espionage -
* Rootkits: Sub the Windows Kernel -
* The Rootkit Arsenal: Escape and E in the Dark Corners of the System -
* Learning Malware Analysis -
* Sandworm -

CheatSheets/Tables:

* IDA Cheat Sheet -
* Cheat Sheets -
* File Signatures -
* APT Groups and Operations -
* Ransomware O -
* Intel Assembler code table -
* ARM Assembly Cheatsheet -
* APTnotes -
* PE 101 -
* PDF 101 -
* PDF analysis -
* Digital Forensics and Incident Response -

CTF's:

* Flare-On -
* LabyREnth -
* Facebook CTF -
* CTF Field Guide -
* RootMe -
* RPISEC CSCI 4968 -
* Crackmes -

Decoders:

* CyberChef -
* Ke RAT decoders -

Debuggers:

* OllyDbg -
* Immunity Debugger -
* X64dbg -
* Rvmi -
* WinDBG -

Disassemblers:

* IDA Pro -
* Binary Ninja -
* Radare2 -
* Cutter -
* BinNavi -
* Hopper -
* medusa -
* Disassembler.io -
* Ghidra -

Document Analysis Tools:

* OfficeMalScanner/DisView -
* AnalyzePDF -
* BiffView -
* oletools -
* Origami Framework -
* PDF Stream Dumper -
* CERMINE -
* pdfid -
* PDFwalker -
* Peepdf -
* pev -
* FOCA -
* LuckyStrike -
* RTF Cleaner -
* RTFScan -

Dynamic/Beha Analysis Tools:

* CaptureBAT -
* Sysinternals Suite -
* ProcDOT -
* Process Hacker -
* Sysmon -
* API Monitor -
* Regshot -
* SwiftonSecurity Sysmon Config -
* Capture-Py -
* Windows Kernel Explorer -

Funny/Random:

* Win95 defrag -
* Little Bobby -
* Dilbert -
* XKCD -
* Why the fuck was i breached -
* -

Honeypots:

* Modern Honey Network -

ICS:

* Graphical Realism Framework for Industrial Control Simulations -
* ꓘamerka -

IDA:

* stackstring_static.py -
* emotet_payload_decryption.py -
* VB IDC -
* Diaphora -
* BinDiff -
* fnfuzzy -
* BinDiff wrapper -
* simpliFiRE.IDAscope -
* IDA Plugins -
* FindCrypt -

IOT:

* Binwalk -
* JTAG Explained -
* Firmware Analysis Toolkit -
* Saleae Logic Analyzer software -

IR:

* Detecting Lateral Mo through Tracking Event Logs -
* Incident Response Methodologies -
* MITRE ATT&CK Framework -

Ja Deobfuscation Tools:

* SpiderMonkey (js) -
* Malzilla -
* Malware-Jail -

LNK File Analysis:

*

MAC:

* MacOS Papers, Slides and Thesis Archive -
* norimaci -
* DTrace: [e than] strace for OS X -

Malware Repo's:

* MalwareBazaar -
* -
* MalShare -
* CyberCrime Tracker -
* TheZoo -
* Endgame Ember -
* Global ATM Malware Wall -
* What is this C2 -
* Connect Trojan -
* C2 Tracker -
* -

Maps / Stats (eye candy):

* ThreatButt -
* BitDefender -
* FireEye -
* Global Incident Map -
* Tor Flow -
* Kaspersky Cybermap -
* Security Wizardry -
* Norse Attack Map -
* Digital Attack Map -
* Stats -
* Current Cyber Attacks -
* FSecure -
* Talos -
* Security Wizardry -
* Ransomware Attack Map -

Memory Forensics:

* -
* Memoryze -
* DumpIt -
* Hibr2Bin -
* Rekall Memory Forensic Framework -
* Clonezilla -
* dd -
* Fog -
* Forensic Toolkit (FTK) -
* Redline -
* MemLabs -

Misc Tools:

* File Signature Analysis -
* EKFiddle -
* XMind -
* ExamDiff -
* 7zip -
* Studio -
* WinSCP -
* Putty -
* TreeSizeFree -
* OneNote -
* KeePass -
* ExifTool -
* RegEx 101 -
* Byte Counter -
* Utilu IE Collection -
* UserAgentString -
* Maltego -
* Cmder -
* MalPull -
* StringSifter -

.Net Debuggers/Decompilers:

* ILSpy -
* dnSpy -
* dotPeek -
* de4dot -
* Reflector -

Network Analysis:

* Wireshark -
* Network Miner -
* LogRhythm Network Monitor Freemium -
* dig -
* curl -
* ApateDNS -
* NetCat -
* Nslookup -
* PDF Stream Dumper -
* Robtex -
* Belati -
* Ostinato -
* Burp Suite -
* Hak5 -
* Fiddler -
* Shodan -
* FakeNet-NG -
* Netzob -
* DShell -
* SecurityOnion -
* Reverse engineering network protocols - Reverse Engineering Network Protocols
* MITMProxy -
* DNSChef -

Operating Systems:

* Remnux -
* SIFT -
* Kali -
* CAINE -
* Metasploitable 3 -
* DVWA -
* Security Onion -
* FLARE VM -
* OWASP WebGoat -
* OWASP Bricks -
* OWASP Mantra -
* Tails -
* Whonix -
* Santoku -

OSINT Online Tools:

* OSINT Gathering -
* Automating OSINT Blog -
* SpiderFoot -
* Buscador -

Password Cracking:

* Hashcat -
* Crack.sh -
* Mimikatz -
* Ophcrack -

Podcasts:

* Security Now -
* SANS Stormcast -
* Down the Security Rabbithole -
* Defensi -
* Paul's Security Weekly -
* RunAs Radio -
* Defensi Podcast -
* Darknet Diaries -
* Risky Business Podcast -
* Security Nation Podcast -
* Smashing Security -

PowerShell decoding:

* PSDecode -
* PyPowerShellXray -
* PowerShellRunBox: Analyzing PowerShell Threats Using PowerShell Debugging -

Ransomware:

* No More Ransomware -
* ID Ransomware -
* Emisoft decrypters -

Reading Material:

* Reverse Engineering for Beginners -
* Phrack -
* Crypto 101 -
* Hacker Manifesto -
* How to Become a Hacker -
* Zines -
* Hackaday -
* Hacktress -
* Reddit -
* Windows API Index - ).aspx
* Raw Hex -
* DigiNinja -
* Team Cymru -
* Lenny Zeltser -
* O -
* HackBack -
* FlexiDie -
* DefCon archive -
* Malwology -
* Stuxnet's Footprint in memory with -
* AtomBombing -
* Malware Archaeology -
* ShinoLocker -
* A crash course in x86 assembly for reverse engineers -
* Zero Days, Thousands of Nights -
* Shadow Brokers Exploit Reference Table -
* GracefulSecurity -
* Cybersecurity ain't easy. Let's talk about it -
* How to become the best malware analyst e-v-e-r -
* Definiti of De Debug Details – Part One: PDB Paths and Malware -
* Dr Fu's Security Blog -
* Encoding -
* Introduction to reverse engineering and Assembly -
* Getting started with reverse engineering -
* Guide to x86 Assembly -
* Nightmare (RE) -
* PDB Files: What Every De Must Know -
* BOLO: Reverse Engineering — Part 1 (Basic Programming Concepts) -
* BOLO: Reverse Engineering — Part 2 (Ad Programming Concepts) -
* String Hashing: Reverse Engineering an Anti-Analysis Control -
* Ground Zero: Part 1 – Reverse Engineering Basics – Linux x64 -
* Let's Build a Compiler -
* Static Malware Analysis with OLE Tools and CyberChef -
* An Introduction to Reverse Engineering -
* -
* Tracking Ad Persistent Threats (APTs) Code -
* YARA Hunting for Code Reuse: DoppelPaymer Ransomware & Dridex Families -
* Here We GO: Crimeware Virus & APT Journey From “RobbinHood” to APT28 -
* The mysterious case of C: the hunt for a Microsoft Sil 0-day -
* Process Injection part 1 of 5 -
* OSINT : Chasing Malware + C&C Servers -
* Daily dose of malware -
* Tracking Malware with Import Hashing -
* STOMP 2 DIS: Brilliance in the () Basics -
* Ad Binary Deobfuscation -
* A Case Study Into Solving Crypters/packers in Malware Obfuscation Using an SMT Approach -
* ReCon Montreal Archives -
* FLARE IDA Pro Script Series: MSDN Annotations IDA Pro for Malware Analysis -
* Analyzing Modern Malware Techniques - Part 1 (of 4) -
* What Every Computer Programmer Should Know About Windows API, CRT, and the Standard C++ Library -
* theForger's Win32 API Programming Tutorial -
* Unbreakable Cryptography in 5 Minutes -
* Let’s play (again) with Predator the thief -
* Introduction -
* Azorult loader stages -
* Re Malware Command and Control: From Sockets to COM -
* Indicators of Compromise (IoCs) and Their Role in Attack Defence -
* Zombieland CTF – Reverse Engineering for Beginners -
* Fu11Shade Windows Exploitation -

Sandbox Tools (Online):

* -
* Malwr -
* Reverse.it -
* Open Analysis -
* ANY.RUN -
* Hybrid Analysis -
* Intezer Analyze -

Sandbox Tools (Offline):

* Noriben -
* Cuckoo -
* PyREBox -
* Viper -
* MISP -
* Sandboxie -
* Ph0neutria -
* FlareVM -

Shellcode Tools:

* JMP2IT -
* Shellcode2exe.py -
* Con -
* scdbg -

Static Analysis Tools:

* PEiD -
* McAfee FileInsight -
* HashMyFiles -
* CFF Explorer -
* AnalyzePESig -
* ByteHist -
* Exeinfo -
* Scylla -
* MASTIFF -
* PEframe -
* PEscan -
* PEstudio -
* PE-Bear -
* PE-sieve -
* Flare-Floss -
* PatchDiff2 -
* PE Insider -
* Resource Hacker -
* DarunGrim -
* Mal Tindex -
* Manalyze -
* PDBlaster -
* ImpFuzzy -
* Florentino -
* Viper -

Text/hex Editor Tools:

* Notepad++ -
* 010 Editor -
* HxD -
* BinText -
* Hexinator -

Threat Intelligence:

* ThreatMiner -
* RiskIQ Community -
* PasteBin -
* Shodan -
* Censys -
* DNSdumpster -
* URLHaus -
* AlienVault OTX -
* C2 Tracker -
* MISP -
* The Hive -
* Yeti -
* Using ATT&CK for CTI Training -
* PasteScraper -

Training:

* Cybrary -
* Corelan Team -
* Open Security Training -
* Offensi Security -
* PentesterLab -
* Malware Traffic Analysis -
* MIT Open Courseware -
* OALabs -
* OALabs -
* MalwareAnalysisForHedgeHogs -
* Malware Unicorn -
* Tuts4You -
* Lenas Re for Newbies -
* Introduction to WinDBG -
* Colin Hardy -
* OWASP AppSec Tutorials -
* Modern Binary Exploitation -
* FuzzySecurity -
* Linux Journey -
* Pi -
* Security Tube -
* Packet Life Cheat Sheets -
* SecurityXploded -
* MalwareMustDie -
* Win32Assembly -
* RPISEC -
* RPISEC -
* Reverse Engineering Challenges -
* HackerOne -
* Google Python Class -
* Guide to x86 Assembly -
* Code Blocks -
* Wireshark Course -
* Maltrak Malware Analyst webinar -
* Intro to ARM assembly basics -
* Life in Hex -
* The Cuckoo's Egg Decompiled Online Course -
* Creating Yara Rules for Malware Detection -
* Windows Pri Escalation Guide -
* Amr Thabet shellcode training -
* Hexacorn Con Shellcode to Portable Executable (32- and 64- bit) -
* Learn Forensics with Da -
* Raphael Mudge (, In-memory e/detection) -
* Assembly programming tutorial -
* RPISec Training -
* Intro to Computer Science -
* Ringzer0 -
* Re Hero -
* MIT Open Courseware -
* Reverse Engineering and malware analysis 101 -
* Reverse engineering intel x64 -
* C++ Tutorial for Beginners - Full Course -
* ELF Re Tutorial -
* Ad Tactics: PowerShell -
* Malware Unicorn Reverse Engineering 101 -
* Modern Binary Exploitation -
* Ghidra Courses -
* Technical Writing Courses -
* Introduction to Malware Analysis and Reverse Engineering -
* Binary Analysis Course -
* Josh Stroschein -
* How to hack together your own CS degree online for free -
* Zero 2 Automated -

Unpacking:

* UnpacMe -
* Unipacker -

Tools:

* pcodedmp -
* -
* -

Video:

* Teach Yourself Computer Science -
* CS50 at Harvard -
* J4vv4D -
* Movies for Hackers -
* Can You Hack It -
* Chris Nickerson talk -
* Zoz - Don't Fuck it Up -
* Rob Joyce (NSA) - Disrupting Nation State Hackers -
* Movies for Hackers -
* Wannacry: The Marcus Hutchins Story - All 3 Chapters -
* DEF CON 23 - Chris Domas - Repsych: Psychological Warfare in Reverse Engineering -
* SAS2018: Finding aliens, star weapons and ponies with YARA -

XOR Decoding Tools:

* bbcrack -
* Brutexor -
* Con -
* NoMoreXOR -

Yara Related:

* Yara -
* Stringless Yara Rules -
* YarGen -
* Yara-Rules -
* CONFidence 2019: "Utilizing YARA to Find E Malware" - Jay Rosenberg -
* SANS Webcast - YARA - Effectively using and generating rules -
* Klara -
* Open Source Yara Rules -

项目信息

开发语言：未知

Star 数：833

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A not so awesome list of malware gems for aspiring malware analysts展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。