Alternatives and similar repositories for EMBER2024

Users that are interested in EMBER2024 are comparing it to the libraries listed below

• ucsb-seclab / popkorn-artifact
  ☆83Updated 2 months ago
• 0x534a / dynmx
  Signature-based detection of malware features based on Windows API call sequences. It's like YARA for sandbox API traces!
  ☆82Updated 2 years ago
• airbus-cert / yara-ttd
  Use YARA rules on Time Travel Debugging traces
  ☆95Updated 2 years ago
• br0kej / bin2ml
  A command line tool for extracting machine learning ready data from software binaries powered by Radare2
  ☆72Updated 5 months ago
• reecdeep / hollowise
  Hollowise is a tool that implements process hollowing and PPID (Parent Process ID) spoofing techniques for masking a legitimate analysis …
  ☆39Updated 8 months ago
• YoavLevi / IAT-Tracer
  An automation plugin for Tiny-Tracer framework to trace and watch functions directly out of the executable's import table or trace logs (…
  ☆120Updated last year
• hugsy / recon_2024_windbg_workshop
  ☆74Updated last year
• 20urc3 / Aplos
  Aplos an extremely simple fuzzer for Windows binaries.
  ☆67Updated 8 months ago
• FuzzySecurity / BulkBindex
  Winbindex bot to pull in binaries for specific releases
  ☆48Updated 2 years ago
• rad9800 / RansomFS
  ☆32Updated 8 months ago
• fr0gger / MalwareMuncher
  Malware Muncher is a proof-of-concept Python script that utilizes the Frida framework for binary instrumentation and API hooking, enablin…
  ☆45Updated 2 years ago
• thewhiteninja / deobshell
  Powershell script deobfuscation using AST in Python
  ☆72Updated last month
• WithSecureLabs / GarbageMan
  GarbageMan is a set of tools for analyzing .NET binaries through heap analysis.
  ☆118Updated 2 years ago
• zRapha / FAME
  Framework for Adversarial Malware Evaluation.
  ☆34Updated 6 months ago
• t-tani / defender2yara
  Convert Microsoft Defender Antivirus Signatures (VDM) into YARA rules
  ☆130Updated this week
• airbus-cert / minusone
  Powershell Linter
  ☆84Updated this week
• magicsword-io / bootloaders
  bootloaders.io is a curated list of known malicious bootloaders for various operating systems. The project aims to assist security profes…
  ☆68Updated 2 years ago
• moohax / aiv_workshop_20
  ☆10Updated 4 years ago
• csvl / SEMA
  SEMA is based on angr, a symbolic execution engine used to extract API calls. Especially, we extend ANGR with strategies to create repr…
  ☆116Updated 7 months ago
• packing-box / dataset-packed-pe
  Dataset of packed PE samples
  ☆39Updated last year
• yo-yo-yo-jbo / virtual_memory_known_dlls
  ☆20Updated 2 years ago
• tyranid / windows-memory-access-traps
  A few examples of how to trap virtual memory access on Windows.
  ☆34Updated 10 months ago
• elastic / siglearn
  Code for BH21 talk: "Generating YARA Rules by Classifying Malicious Byte Sequences"
  ☆17Updated 8 months ago
• t0-retooling / defender-recon24
  ☆53Updated last year
• eversinc33 / TriageMCP
  Vibe Malware Triage - MCP server for static PE analysis.
  ☆71Updated 5 months ago
• intel471 / coderex
  A tool that automates regex generation for the x86 and x86-64 instruction sets
  ☆71Updated last year
• nasbench / SEDR-Internals
  Symantec EDR Internals
  ☆28Updated 4 years ago
• airbus-cert / vbSparkle
  VBScript & VBA source-to-source deobfuscator with partial-evaluation
  ☆80Updated last year
• therealdreg / dregate
  call gates as stable comunication channel for NT x86 and Linux x86_64
  ☆32Updated 2 years ago
• danielplohmann / mcrit
  The MinHash-based Code Relationship & Investigation Toolkit (MCRIT) is a framework created to simplify the application of the MinHash alg…
  ☆94Updated last week