R3MRUM / loki-parse
A python script that can detect and parse loki-bot (malware) related network traffic. This script can be helpful to DFIR analysts and security researchers who want to know what data is being exfiltrated to the C2, bot tracking, etc...
☆13Updated 2 years ago
Related projects ⓘ
Alternatives and complementary repositories for loki-parse
- This script is used for extracting DDE in docx and xlsx☆12Updated 6 years ago
- Analysis PE file or Shellcode☆48Updated 8 years ago
- Various snippets created during malware analysis☆22Updated 6 years ago
- Shows command lines used by latest instances analyzed on Hybrid-Analysis☆43Updated 6 years ago
- a modified version base on Tracecorn☆20Updated 5 years ago
- API functions for Malware Research☆35Updated 5 years ago
- Collection of my Python Scripts☆41Updated 4 years ago
- Resolves DLL API entrypoints for a process w/ remote query capabilities.☆55Updated 7 years ago
- IDA Pro plugin that rename functions on load, based on functionality☆19Updated 6 years ago
- Handy scripts to speed up malware analysis☆35Updated last year
- Tools to enumerate Windows Firewall Hook Drivers on Windows 2000, XP and 2003☆20Updated 9 years ago
- Tool for dropping malware from EK☆41Updated 6 years ago
- A Maltego transform for VirusTotal Submitter Information☆31Updated 5 years ago
- Work Fast With the pattern matching swiss knife for malware researchers.☆35Updated 8 years ago
- Python based module to find common vulnerabilities which lead to Windows privilege escalation☆32Updated 8 years ago
- ☆22Updated 7 years ago
- Royal APT - APT15 - Related Information from NCC Group Cyber Defense Operations Research☆53Updated 6 years ago
- Volatility Framework plugin to detect various types of hooks as performed by banking Trojans☆40Updated 5 years ago
- Script to extract malicious payload and decoy document from CVE-2015-1641 exploit documents☆23Updated 7 years ago
- hopefully a source-to-source deobfuscator, aiming at deobfuscating common scripts languages such as Powershell, VBA and Javascript. Curre…☆40Updated 5 years ago
- Automatically exported from code.google.com/p/malware-lu☆55Updated 5 years ago
- Talk given at DerbyCon and RuxCon 2016☆22Updated 8 years ago
- Hansel - a simple but flexible search for IDA☆26Updated 5 years ago
- A repo to hold some scripts pertaining WMI (Windows implementation of WBEM) forensics☆85Updated 7 years ago