Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches). Uses: PE-sieve (the library version). PE-sieve FAQ - Frequently Asked Questions Read Wiki Clone Use recursive clone to get the repo together with all the submodules: git clone --recursive https://github.com/hasherezade/hollows_hunter.git Builds Download the latest release, or read more. Available also via Chocolatey
FEATURES
SIMILAR TOOLS
A program to manage yara ruleset in a database with support for different databases and configuration options.
A binary analysis and management framework for organizing and analyzing malware and exploit samples, and creating plugins.
Intezer is a cloud-based malware analysis platform that detects and classifies malware using genetic code analysis.
A sandbox for quickly sandboxing known or unknown families of Android Malware
A static analysis tool for PE files that detects malicious behavior and provides information for manual analysis.
PINNED

Checkmarx SCA
A software composition analysis tool that identifies vulnerabilities, malicious code, and license risks in open source dependencies throughout the software development lifecycle.

Orca Security
A cloud-native application protection platform that provides agentless security monitoring, vulnerability management, and compliance capabilities across multi-cloud environments.

DryRun
A GitHub application that performs automated security code reviews by analyzing contextual security aspects of code changes during pull requests.