Malware Research Python Packages

iocextract

Defanged Indicator of Compromise (IOC) Extractor.

ioc-fanger

Fang and defang indicators of compromise. You can test this project in a GUI here: http://ioc-fanger.hightower.space .

ioc-finder

Simple, effective, and modular package for parsing observables (indicators of compromise (IOCs), network data, and other, security related information) from text. It uses grammars rather than regexes which makes it more readable, maintainable, and hackable. Explore our interactive documentation here: https://hightower.space/ioc-finder/

pyhidra

Pyhidra is a Python library that provides direct access to the Ghidra API within a native CPython interpreter using jpype.

apkid

Android Application Identifier for Packers, Protectors, Obfuscators and Oddities - PEiD for Android

karton-core

Distributed malware processing framework based on Python, Redis and S3.

malwaredb

MalwareDB: bookkeeping for malware, goodware, and unknown files with relationship discovery

die-python

Native Python3 bindings for @horsicq's Detect-It-Easy

pywhat

🐸 Identify anything. pyWhat easily lets you identify emails, IP addresses, and more. Feed it a .pcap file or some text and it'll tell you what it is! 🧙‍♀️

threatingestor

Extract and aggregate threat intelligence.

vt

VirusTotal Full api

bintropy

Analysis tool for estimating the likelihood that a binary contains compressed or encrypted bytes

peid

Python implementation of the Packed Executable iDentifier (PEiD)

mwdb-core

MWDB Core malware database

karton-classifier

File type classifier for the Karton framework.

reminder-detector

Implementation of the packing detection heuristic from the paper "Packed PE File Detection for Malware Forensics" of Han et al.

pypackerdetect

Packing detection tool for PE files

malware-atlas

ATLAS - Malware Analysis Description

python-see

Sandboxed Execution Environment

dumpulator

An easy-to-use library for emulating memory dumps. Useful for malware analysis (config extraction, unpacking) and dynamic analysis in general (sandboxing).

visualize-logs

A Python library and command line tools to provide interactive log visualization.

karton-archive-extractor

Extractor of various archive formats for Karton framework

karton-dashboard

A small Flask application that allows for Karton task and queue introspection.

karton-config-extractor

Static configuration extractor for the Karton framework