Telekom Security Malware Analysis Repository Logo

Telekom Security Malware Analysis Repository

0
Free
Visit Website

This repository comprises scripts, signatures, and additional IOCs of our blog posts at the telekom.com blog as well as of our Twitter account. 2021-05-17: Let’s set ice on fire: Hunting and detecting IcedID infections (IcedID) 2021-07-14: LOCKDATA Auction – Another leak marketplace showing the recent shift of ransomware operators (CryLock) 2021-09-14: Flubot's Smishing Campaigns under the Microscope (Flubot/Teabot) 2021-10-29: #YARA rule for hunting XOR encrypted #PlugX / #Korplug payloads(PlugX) 2022-01-14: #100DaysOfYara Detect Hacktools that modify RDP settings (Hacktools) 2022-03-11: SystemBC YARA rule and extractor (SystemBC) 2022-03-18: #100DaysOfYara Detect Vatet Loader in backedoored Rufus([Defray777])(https://github.com/telekom-security/malware_analysis/tree/main/defray777) 2022-09-02: Raspberry Robin(IOCs)

FEATURES

ALTERNATIVES

A powerful tool for detecting and identifying malware using a rule-based system.

A tool for identifying and analyzing Java serialized objects in network traffic

UDcide provides an alternative approach to dealing with Android malware by targeting specific behaviors for removal.

A .NET wrapper for libyara that provides a simplified API for developing tools in C# and PowerShell.

PINCE is a front-end/reverse engineering tool for the GNU Project Debugger (GDB), focused on games, with CheatEngine-like value type support and memory searching capabilities.

Kaitai Struct is a declarative language for describing binary data structures.

Automate the exploitation of XXE vulnerabilities

A strings statistics calculator for YARA rules to aid malware research.