Malware Python Packages

ioc-fanger

Fang and defang indicators of compromise. You can test this project in a GUI here: http://ioc-fanger.hightower.space .

volatility3

Volatility 3.0 development

blocklist-aggregator

Domains blocklist aggregator - Create your own list from several sources.

apk-info

APK full-featured parser

blint

blint is a Binary Linter that checks the security properties and capabilities of your executables. It can also generate a Software Bill-of-Materials (SBOM) for supported binaries.

autoit-ripper

Extract AutoIt scripts embedded in PE binaries

malwaredb

MalwareDB: bookkeeping for malware, goodware, and unknown files with relationship discovery

die-python

Native Python3 bindings for @horsicq's Detect-It-Easy

debloat

A GUI and CLI tool for removing bloat from executables

malwoverview

Malwoverview is a first response tool for threat hunting across VirusTotal, Hybrid Analysis, URLHaus, Polyswarm, Malshare, Alien Vault, Malpedia, Malware Bazaar, ThreatFox, Triage, IPInfo, Shodan, AbuseIPDB, GreyNoise, URLScan.io, Whois/RDAP, NIST, and VulnCheck. Supports LLM enrichment, IOC extraction, YARA scanning, and Android analysis.

virustotal-python

A Python library to interact with the public VirusTotal v3 and v2 APIs.

pywhat

🐸 Identify anything. pyWhat easily lets you identify emails, IP addresses, and more. Feed it a .pcap file or some text and it'll tell you what it is! 🧙‍♀️

wordfence

Wordfence malware and vulnerability scanner command line utility.

yaralyzer

Visually inspect and force decode YARA and regex matches found in both binary and text data with colors. Lots of colors.

intelmq

IntelMQ is a solution for IT security teams for collecting and processing security feeds using a message queuing protocol.

malwi

malwi - AI Python Malware Scanner

ts-deepscan

Repository scanner for the identification of effective licenses and copyright information.

yarobot

Simple YARA rules generator with web interface, API, and cli

yara-mail

A Python package and command line utility for scanning emails with YARA rules

malwarebazaar

Python based CLI for MalwareBazaar

pyimpfuzzy

Fuzzy Hash calculated from import API of PE files

opensquat

The openSquat is an open-source tool for detecting domain look-alikes by searching for newly registered domains that might be impersonating legit domains and brands.

virusxcheck

Cross-check file hashes against Virus Exchange and VirusTotal databases

malware-atlas

ATLAS - Malware Analysis Description