Reverse Engineering

Loki Simple IOC and Incident Response Scanner https://github.com/Neo23x0/Loki

Digging Up the Past: Windows Registry Forensics Revisited https://www.fireeye.com/blog/threat-research/2019/01/digging-up-the-past-windows-registry-forensics-revisited.html

speakeasy Windows kernel and user mode emulation. https://github.com/fireeye/speakeasy

A modern Java bytecode editor https://github.com/Col-E/Recaf

Course materials for Advanced Binary Deobfuscation by NTT Secure Platform Laboratories https://github.com/malrev/ABD

MalConfScan a Volatility plugin extracts configuration data of known malware. Volatility is an open-source memory forensics framework for incident response and malware analysis. This tool searches for malware in memory images and dumps configuration data. In addition, this tool has a function to list strings to which malicious code refers. https://github.com/JPCERTCC/MalConfScan

Observing COM within Malicious Code https://blog.malwarebytes.com/threat-analysis/2014/02/observing-com-within-malicious-code/

Hunting COM Objects https://malware.news/t/hunting-com-objects/30207

New Ursnif Variant Spreading by Word Document https://www.fortinet.com/blog/threat-research/ursnif-variant-spreading-word-document

Threat Research Reversing Malware Command and Control: From Sockets to COM https://www.fireeye.com/blog/threat-research/2010/08/reversing-malware-command-control-sockets.html

Latest malware news and threat information exchange forum. Malware analysis, indicators, reports and educational resources. https://malware.news/

PE Tree Python module for viewing Portable Executable (PE) files in a tree-view using pefile and PyQt5. Can also be used with IDA Pro to dump in-memory PE files and reconstruct imports. https://github.com/blackberry/pe_tree

Take a look into the depths of Windows kernels and reveal more than 60000 undocumented structures https://www.vergiliusproject.com/

script will annotate and bookmark the code with tags produced by tool Tiny Tracer https://github.com/Dump-GUY/ghidra_scripts

capa detects capabilities in executable files. You run it against a PE file or shellcode and it tells you what it thinks the program can do. For example, it might suggest that the file is a backdoor, is capable of installing services, or relies on HTTP to communicate. https://github.com/fireeye/capa