# hollows_hunter

hollows_hunter is a Malware Analysis product. It runs on-premises. Pricing is free.

A process scanning tool that detects and dumps malicious implants, shellcodes, hooks, and memory patches in running processes.

Checked October 2026.

## What is hollows_hunter?

hollows_hunter is a process scanning tool that analyzes all running processes on a system to identify potentially malicious implants and modifications.

The tool detects various types of malicious activities including:
- Replaced or implanted PE (Portable Executable) files
- Shellcode injections in process memory
- API hooks and function redirections
- In-memory patches and modifications

Built on the PE-sieve library, hollows_hunter provides automated scanning capabilities to identify processes that have been compromised or modified by malware. The tool can dump detected malicious implants for further analysis.

The scanner operates by examining process memory structures and comparing them against expected patterns to identify anomalies that may indicate malicious activity. It supports recursive cloning for development and is available through multiple distribution channels including direct releases and package managers like Chocolatey.

Tags: PE File, Shellcode, Memory Forensics, Windows, Process Injection

## Where it fits in your security program (NIST CSF 2.0)

- [Detect](https://cybersectools.com/guides/building-detect-program-small-team): helps you spot attacks and unusual activity.
- [Respond](https://cybersectools.com/guides/building-respond-program-small-team): helps you contain and handle incidents.

## Quick facts

- Category: [Security Operations](https://cybersectools.com/categories/security-operations) · [Malware Analysis](https://cybersectools.com/categories/malware-analysis)
- Deployment: On-Premises
- Company size fit: Startup, SMB, Mid-Market, Enterprise
- Pricing model: Free
- GitHub stars: 2,318
- Website: github.com

## Where it ranks

No shortlist covers this product's category yet. The closest is [Best MDR Solutions for Business](https://cybersectools.com/shortlists/best-mdr-solutions).

## hollows_hunter FAQ

### What is hollows_hunter?

hollows_hunter is a product in the Malware Analysis category. It covers PE File, Shellcode and Memory Forensics.

### What is the pricing for hollows_hunter?

hollows_hunter is free. Download and setup instructions are at https://github.com/hasherezade/hollows_hunter/.

### What are alternatives to hollows_hunter?

Alternatives to hollows_hunter listed on CybersecTools:

1. [DTRSEC REnigma](https://cybersectools.com/tools/dtrsec-renigma) - Sandbox platform for interactive malware detonation, record/replay, and forensic analysis (Commercial)
2. [Joe Sandbox DEC](https://cybersectools.com/tools/joe-sandbox-dec) - Plugin that decompiles malware PE files into readable C code using hybrid analysis. (Commercial)
3. [Threatray](https://cybersectools.com/tools/threatray) - AI-driven binary code analysis platform for malware detection & intelligence. (Commercial)
4. [Antiy Labs PTA](https://cybersectools.com/tools/antiy-labs-pta) - APT-focused file threat analysis system using dynamic & static detection. (Commercial)
5. [Stairwell Analyze](https://cybersectools.com/tools/stairwell-analyze) - Continuous, private malware analysis and threat intel platform for enterprises. (Commercial)

Compare all hollows_hunter alternatives at [https://cybersectools.com/alternatives/hollowshunter](https://cybersectools.com/alternatives/hollowshunter)

### What deployment and organization size does hollows_hunter fit?

hollows_hunter is available as on-premises software. It is listed for startups, small businesses, mid-market companies and enterprises. It is free.

## Compare hollows_hunter with similar solutions

- [hollows_hunter vs DTRSEC REnigma](https://cybersectools.com/compare/dtrsec-renigma-vs-hollowshunter)
- [hollows_hunter vs Joe Sandbox DEC](https://cybersectools.com/compare/hollowshunter-vs-joe-sandbox-dec)
- [hollows_hunter vs Threatray](https://cybersectools.com/compare/hollowshunter-vs-threatray)

All alternatives to hollows_hunter: [/alternatives/hollowshunter](https://cybersectools.com/alternatives/hollowshunter)

---

Source: https://cybersectools.com/tools/hollowshunter

For AI agents: every CybersecTools shortlist is listed at https://cybersectools.com/shortlists.md, and any compare page has a Markdown copy too (add .md to its URL).

More on hollows_hunter: funding, momentum, hiring and news, plus the full product and company record, are available through the Mandos MCP Server (paid plans), which connects to AI assistants: https://mandos.io/mcp?utm_source=cybersectools.com&utm_medium=product-md