| |
| cybersecurity:osint.bkp:docs_malware-cti [2026/08/07 11:15] – created - external edit 127.0.0.1 | cybersecurity:osint.bkp:docs_malware-cti [2026/09/12 22:00] (current) – removed - external edit (Unknown date) 127.0.0.1 |
|---|
| ===== 🦠 Malware Analysis & CTI ===== | |
| |
| [[../README|← Back to Index]] | |
| |
| ==== Malware Analysis Platforms ==== | |
| Use these platforms to analyze suspicious files, URLs, or scripts, and identify malicious behavior, network activity, and indicators. | |
| |
| * [[https://www.virustotal.com/|VirusTotal]] — Multi-engine malware scanner with IOC and sandbox integrations | |
| * [[https://www.hybrid-analysis.com/|Hybrid Analysis]] — Dynamic malware analysis platform showing behavior and network calls | |
| * [[https://any.run/|ANY.RUN]] — Interactive sandbox for live malware execution and observation | |
| * [[https://cuckoosandbox.org/|Cuckoo Sandbox]] — Open-source automated malware analysis system | |
| * [[https://analyze.intezer.com/|Intezer Analyze]] — Code-reuse and malware lineage analysis | |
| * [[https://www.joesecurity.org/|Joe Sandbox]] — Advanced commercial sandbox environment | |
| * [[https://bazaar.abuse.ch/|MalwareBazaar]] — Repository of malware samples and hashes | |
| |
| ==== Malware Analysis Tools ==== | |
| Toolkits and utilities for static and dynamic analysis of binaries, scripts, and executables. | |
| |
| * [[https://remnux.org/|Remnux]] — Linux distribution for reverse engineering and malware analysis | |
| * [[https://virustotal.github.io/yara/|YARA]] — Pattern-matching engine for malware detection and classification | |
| * [[https://www.winitor.com/|PEStudio]] — Windows executable analyzer for metadata and indicators | |
| * [[https://github.com/mandiant/capa|Capa]] — Detects capabilities and functionality in executable files | |
| * [[https://github.com/horsicq/DIE-engine|Die (Detect It Easy)]] — PE analysis tool for structure, entropy, and packers | |
| |
| ==== Reverse Engineering & Disassembly ==== | |
| Tools for deep binary inspection, debugging, and reverse engineering of malware samples. | |
| |
| * [[https://ghidra-sre.org/|Ghidra]] — Open-source reverse engineering suite developed by the NSA | |
| * [[https://hex-rays.com/ida-free/|IDA Free]] — Disassembler and debugger with visual graph analysis | |
| * [[https://binary.ninja/|Binary Ninja]] — Modern and scriptable reverse engineering platform | |
| * [[https://x64dbg.com/|x64dbg]] — Open-source Windows debugger for malware analysis | |
| |
| ==== Network & Behavior Analysis ==== | |
| Monitor process activity, file system changes, and network communications of suspicious samples. | |
| |
| * [[https://www.wireshark.org/|Wireshark]] — Network packet capture and protocol analyzer | |
| * [[https://learn.microsoft.com/en-us/sysinternals/downloads/procmon|Procmon]] — Real-time monitoring of file, registry, and process activity | |
| * [[https://www.fireeye.com/services/freeware/apatedns.html|ApateDNS]] — DNS redirection tool for malware network simulation | |
| * [[https://github.com/mandiant/flare-fakenet-ng|FakeNet-NG]] — Network emulation tool for capturing malware traffic | |
| |
| ==== Malware Feeds & Repositories ==== | |
| Live sources of malware samples, indicators, and research materials. | |
| |
| * [[https://malpedia.caad.fkie.fraunhofer.de/|Malpedia]] — Structured database of malware families and samples | |
| * [[https://vx-underground.org/|VX Underground]] — Archive of malware source code and research papers | |
| * [[https://urlhaus.abuse.ch/|URLhaus]] — Database of malicious URLs submitted by the community | |
| * [[https://feodotracker.abuse.ch/|Feodo Tracker]] — C2 tracking for banking trojans and botnets | |
| * [[https://malshare.com/|MalShare]] — Public malware repository with daily sample updates | |
| |
| ==== Threat Intelligence Platforms ==== | |
| Platforms for collecting, structuring, and sharing threat intelligence data. | |
| |
| * [[https://www.misp-project.org/|MISP]] — Open-source platform for sharing threat intelligence and IOCs | |
| * [[https://www.opencti.io/en/|OpenCTI]] — Knowledge graph for cyber threat intelligence management | |
| * [[https://yeti-platform.github.io/|YETI]] — Framework for storing and correlating threat data | |
| * [[https://threatconnect.com/|ThreatConnect]] — Commercial CTI platform with automation and analytics | |
| * [[https://www.eclecticiq.com/platform|EclecticIQ Platform]] — Enterprise-grade CTI management and analysis platform | |
| * [[https://www.aboutintel.com/|AboutIntel]] - Freemium TI and AS monitor to deliver relevant, actionable security insights. Without the noise. | |
| |
| ==== IOC Enrichment & Internet Scanners ==== | |
| Tools for IOC enrichment, infrastructure mapping, and exposure analysis of malicious ecosystems. | |
| |
| * [[https://silentpush.com|SilentPush]] - Track, monitor and counteract global threat activity. | |
| * [[https://validin.com|Validin]] - Explore and track threats across key attributes for public infrastructure tracking | |
| * [[https://www.threatminer.org/|ThreatMiner]] — Data mining for IOCs, malware, SSL, and related artifacts | |
| * [[https://abuse.ch/|Abuse.ch]] — Home to ThreatFox, Feodo Tracker, URLhaus, and SSLBL projects | |
| * [[https://www.greynoise.io/|GreyNoise]] — Contextual intelligence on internet-scanning IPs | |
| * [[https://otx.alienvault.com/|AlienVault OTX]] — Community threat intelligence sharing platform | |
| * [[https://maltiverse.com/|Maltiverse]] — IOC enrichment with threat classification and context | |
| * [[https://www.shodan.io/|Shodan]] — Internet-wide search engine for exposed systems | |
| * [[https://censys.io/|Censys]] — Search engine for internet infrastructure and certificates | |
| * [[https://www.binaryedge.io/|BinaryEdge]] — Real-time internet scanning and asset discovery for threat analysis | |
| * [[https://www.criminalip.io/|CriminalIP]] — Attack surface and exposure analysis platform | |
| * [[https://fofa.so/|FOFA]] — Cyber asset search engine widely used in China for exposure research | |
| * [[https://workshop.censys.io/|Censys Workshop]] — Research environment showcasing Censys experimental tools | |
| |
| |
