GitPlanet

Cheap and reliable Node.js hosting starts at $3/month, and $1/month static HTML hosting

Created with love in Canada, visit hostnodejs.com today

Feel like to post an Ad? Learn Details
All Projects → mitre → Multiscanner

mitre / Multiscanner

Licence: mpl-2.0
Modular file scanning/analysis framework

Programming Languages

python
139335 projects - #7 most used programming language

Labels

linuxmalwaremetadatamalware-analysismalware-researchpython-scriptyarascanningantivirus

Projects that are alternatives of or similar to Multiscanner

freki
🐺 Malware analysis platform
Stars: ✭ 327 (-33.81%)
Mutual labels:  malware, malware-analysis, malware-research, yara
Apkid
Android Application Identifier for Packers, Protectors, Obfuscators and Oddities - PEiD for Android
Stars: ✭ 999 (+102.23%)
Mutual labels:  malware-analysis, malware-research, yara, antivirus
yara
Malice Yara Plugin
Stars: ✭ 27 (-94.53%)
Mutual labels:  malware, malware-analysis, malware-research, yara
Malice
VirusTotal Wanna Be - Now with 100% more Hipster
Stars: ✭ 1,253 (+153.64%)
Mutual labels:  malware, malware-analysis, malware-research, antivirus
MalwareHashDB
Malware hashes for open source projects.
Stars: ✭ 31 (-93.72%)
Mutual labels:  malware, antivirus, malware-analysis, malware-research
Owlyshield
Owlyshield is an EDR framework designed to safeguard vulnerable applications from potential exploitation (C&C, exfiltration and impact))..
Stars: ✭ 281 (-43.12%)
Mutual labels:  malware, antivirus, malware-analysis, malware-research
Yargen
yarGen is a generator for YARA rules
Stars: ✭ 795 (+60.93%)
Mutual labels:  malware, malware-analysis, malware-research, yara
binlex
A Binary Genetic Traits Lexer Framework
Stars: ✭ 303 (-38.66%)
Mutual labels:  malware, malware-analysis, malware-research, yara
Freki
🐺 Malware analysis platform
Stars: ✭ 285 (-42.31%)
Mutual labels:  malware, malware-analysis, malware-research, yara
Wdbgark
WinDBG Anti-RootKit Extension
Stars: ✭ 450 (-8.91%)
Mutual labels:  malware, malware-analysis, malware-research
decrypticon
Java-layer Android Malware Simplifier
Stars: ✭ 17 (-96.56%)
Mutual labels:  malware, malware-analysis, malware-research
Simplify
Android virtual machine and deobfuscator
Stars: ✭ 3,865 (+682.39%)
Mutual labels:  malware, malware-analysis, malware-research
malware-writeups
Personal research and publication on malware families
Stars: ✭ 104 (-78.95%)
Mutual labels:  malware, malware-analysis, malware-research
fame modules
Community modules for FAME
Stars: ✭ 55 (-88.87%)
Mutual labels:  malware, malware-analysis, malware-research
Stoq
An open source framework for enterprise level automated analysis.
Stars: ✭ 352 (-28.74%)
Mutual labels:  malware-analysis, malware-research, yara
malice-av
Malice AntiVirus Plugins
Stars: ✭ 98 (-80.16%)
Mutual labels:  malware, antivirus, malware-analysis
Drakvuf Sandbox
DRAKVUF Sandbox - automated hypervisor-level malware analysis system
Stars: ✭ 384 (-22.27%)
Mutual labels:  malware, malware-analysis, malware-research
Batch-Antivirus
Batch Antivirus, a powerful antivirus suite written in batch with real-time protection and heuristical scanning.
Stars: ✭ 26 (-94.74%)
Mutual labels:  malware, antivirus, scanning
MalwareDatabase
One of the few malware collection
Stars: ✭ 37 (-92.51%)
Mutual labels:  malware, malware-analysis, malware-research
Dex Oracle
A pattern based Dalvik deobfuscator which uses limited execution to improve semantic analysis
Stars: ✭ 398 (-19.43%)
Mutual labels:  malware, malware-analysis, malware-research
View All Similar Projects ➔

MultiScanner

Build Status

Introduction

MultiScanner is a file analysis framework that assists the user in evaluating a set of files by automatically running a suite of tools for the user and aggregating the output. Tools can be custom built Python scripts, web APIs, software running on another machine, etc. Tools are incorporated by creating modules that run in the MultiScanner framework.

Modules are designed to be quickly written and easily incorporated into the framework. Currently written and maintained modules are related to malware analytics, but the framework is not limited to that scope. For a list of modules you can look in modules/. Descriptions and config options can be found on the Analysis Modules page.

MultiScanner also supports a distributed workflow for sample storage, analysis, and report viewing. This functionality includes a web interface, a REST API, a distributed file system (GlusterFS), distributed report storage / searching (Elasticsearch), and distributed task management (Celery / RabbitMQ). Please see Architecture for more details.

Usage

MultiScanner can be used as a command-line interface, a Python API, or a distributed system with a web interface. See the documentation for more detailed information on installation and usage.

Command-Line

Install Python (2.7 or 3.4+) if you haven't already.

Then run the following (substituting the actual file you want to scan for <file>):

$ git clone https://github.com/mitre/multiscanner.git
$ cd multiscanner
$ sudo -HE ./install.sh
$ multiscanner init

This will generate a default configuration for you. Check config.ini to see what modules are enabled. See Configuration for more information.

Now you can scan a file (substituting the actual file you want to scan for <file>):

$ multiscanner <file>

You can run the following to get a list of all of MultiScanner's command-line options:

$ multiscanner --help

Note: If you are not on a RedHat or Debian based Linux distribution, instead of running the install.sh script, install pip (if you haven't already) and run the following:

$ pip install -r requirements.txt

Python API

import multiscanner
multiscanner.config_init(filepath)
output = multiscanner.multiscan(file_list)
results = multiscanner.parse_reports(output, python=True)

Web Interface

Install the latest versions of Docker and Docker Compose if you haven't already.

$ git clone https://github.com/mitre/multiscanner.git
$ cd multiscanner
$ docker-compose up

You may have to wait a while until all the services are up and running, but then you can use the web interface by going to http://localhost:8000 in your web browser.

Note: this should not be used in production; it is simply an introduction to what a full installation would look like. See here for more details.

Documentation

For more information, see the full documentation on ReadTheDocs.

Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].