Telekom Security Malware Analysis Repository Logo

Telekom Security Malware Analysis Repository

0
Free
Visit Website

This repository comprises scripts, signatures, and additional IOCs of our blog posts at the telekom.com blog as well as of our Twitter account. 2021-05-17: Let’s set ice on fire: Hunting and detecting IcedID infections (IcedID) 2021-07-14: LOCKDATA Auction – Another leak marketplace showing the recent shift of ransomware operators (CryLock) 2021-09-14: Flubot's Smishing Campaigns under the Microscope (Flubot/Teabot) 2021-10-29: #YARA rule for hunting XOR encrypted #PlugX / #Korplug payloads(PlugX) 2022-01-14: #100DaysOfYara Detect Hacktools that modify RDP settings (Hacktools) 2022-03-11: SystemBC YARA rule and extractor (SystemBC) 2022-03-18: #100DaysOfYara Detect Vatet Loader in backedoored Rufus([Defray777])(https://github.com/telekom-security/malware_analysis/tree/main/defray777) 2022-09-02: Raspberry Robin(IOCs)

FEATURES

ALTERNATIVES

Tool for fingerprinting malware HTTP requests.

BARF is an open source binary analysis framework for supporting various binary code analysis tasks in information security.

A tool to embed XXE and XSS payloads in various file formats

A blog post discussing INF-SCT fetch and execute techniques for bypass, evasion, and persistence

Assembler/disassembler for the dex format used by Dalvik, Android's Java VM implementation.

A .NET wrapper for libyara that provides a simplified API for developing tools in C# and PowerShell.

Explores malware interaction with Windows API and methods for detection and prevention.

OCaml wrapper for YARA matching engine for malware identification

PINNED