GitPlanet

Cheap and reliable Node.js hosting starts at $3/month, and $1/month static HTML hosting

Created with love in Canada, visit hostnodejs.com today

Feel like to post an Ad? Learn Details
All Projects → ANSSI-FR → Polichombr

ANSSI-FR / Polichombr

Licence: other
Collaborative malware analysis framework

Programming Languages

python
139335 projects - #7 most used programming language

Labels

reverse-engineeringsecurity-toolsmalware-analysismalware-researchidaida-plugin

Projects that are alternatives of or similar to Polichombr

Sojobo
A binary analysis framework
Stars: ✭ 116 (-62.21%)
Mutual labels:  security-tools, malware-analysis, malware-research, reverse-engineering
Replica
Ghidra Analysis Enhancer 🐉
Stars: ✭ 194 (-36.81%)
Mutual labels:  security-tools, malware-analysis, reverse-engineering
Drsemu
DrSemu - Sandboxed Malware Detection and Classification Tool Based on Dynamic Behavior
Stars: ✭ 237 (-22.8%)
Mutual labels:  malware-analysis, malware-research, reverse-engineering
Shed
.NET runtime inspector
Stars: ✭ 229 (-25.41%)
Mutual labels:  security-tools, malware-analysis, reverse-engineering
Apkfile
Android app analysis and feature extraction library
Stars: ✭ 190 (-38.11%)
Mutual labels:  malware-analysis, malware-research, reverse-engineering
Malwaresearch
A command line tool to find malwares on http://openmalware.org
Stars: ✭ 190 (-38.11%)
Mutual labels:  malware-analysis, malware-research, reverse-engineering
Rebel Framework
Advanced and easy to use penetration testing framework 💣🔎
Stars: ✭ 183 (-40.39%)
Mutual labels:  security-tools, malware-analysis, reverse-engineering
Jarvis
"Just Another ReVersIng Suite" or whatever other bullshit you can think of
Stars: ✭ 137 (-55.37%)
Mutual labels:  ida, ida-plugin, reverse-engineering
Flare Ida
IDA Pro utilities from FLARE team
Stars: ✭ 1,374 (+347.56%)
Mutual labels:  ida, ida-plugin, reverse-engineering
Idarling
Collaborative Reverse Engineering plugin for IDA Pro & Hex-Rays
Stars: ✭ 588 (+91.53%)
Mutual labels:  ida, ida-plugin, reverse-engineering
Detect It Easy
Program for determining types of files for Windows, Linux and MacOS.
Stars: ✭ 2,982 (+871.34%)
Mutual labels:  malware-analysis, malware-research, reverse-engineering
Freki
🐺 Malware analysis platform
Stars: ✭ 285 (-7.17%)
Mutual labels:  malware-analysis, malware-research, reverse-engineering
Probedroid
A SDK for the creation of analysis tools without obtaining app source code in order to profile runtime performance, examine code coverage, and track high-risk behaviors of a given app on Android 5.0 and above.
Stars: ✭ 182 (-40.72%)
Mutual labels:  malware-analysis, malware-research, reverse-engineering
Xapkdetector
APK/DEX detector for Windows, Linux and MacOS.
Stars: ✭ 208 (-32.25%)
Mutual labels:  malware-analysis, malware-research, reverse-engineering
Antidebugging
A collection of c++ programs that demonstrate common ways to detect the presence of an attached debugger.
Stars: ✭ 161 (-47.56%)
Mutual labels:  malware-analysis, malware-research, reverse-engineering
Nauz File Detector
Linker/Compiler/Tool detector for Windows, Linux and MacOS.
Stars: ✭ 146 (-52.44%)
Mutual labels:  malware-analysis, malware-research, reverse-engineering
Malware Analysis Scripts
Collection of scripts for different malware analysis tasks
Stars: ✭ 61 (-80.13%)
Mutual labels:  malware-analysis, malware-research, reverse-engineering
Malwarelab vm Setup
Setup scripts for my Malware Analysis VMs
Stars: ✭ 126 (-58.96%)
Mutual labels:  malware-analysis, malware-research, reverse-engineering
Scratchabit
Easily retargetable and hackable interactive disassembler with IDAPython-compatible plugin API
Stars: ✭ 369 (+20.2%)
Mutual labels:  ida, ida-plugin, reverse-engineering
Rematch
REmatch, a complete binary diffing framework that is free and strives to be open source and community driven.
Stars: ✭ 141 (-54.07%)
Mutual labels:  ida, ida-plugin, reverse-engineering
View All Similar Projects ➔

Polichombr

Build Status Maintainability Test Coverage

What is Polichombr?

This tool aim to provide a collaborative malware analysis framework.

Documentation

A more detailed documentation is placed in the docs folder

Features

  • Sample storage and documentation
  • Semi automated malware analysis
  • IDA Pro collaboration
  • Online disassembly
  • Binary matching with the MACHOC fuzzy hash algorithm
  • Yara matching

Installation

Please see the corresponding file in the docs directory

Example scripts

Scripts under the folder examples permits some basic actions for a Polichombr instance.

Screenshots

Generic sample informations

screenshot

Family/Threat overview

screenshot

Online disassembly

screenshot

Share IDA Pro informations from the WebUI / directly to other users

screenshot

Automated hotpoints detection

screenshot

Taking notes right from IDA

screenshot

Feature documentation

Malware analysis

Polichombr provides an engine to automate the analysis tasks by identifying points of interest inside the malicious binary, and providing them both on a web interface and inside the analyst's tools via an API.

Plugins / tasks

Analysis tasks are loaded from the app/controllers/tasks directory, and must inherit from the Task object. In particular, several tasks are already implemented:

  • AnalyzeIt, a ruby script based on metasm, wich is used to identify interesting points in the binary. The goal is to help the analyst by giving hints about where to start. For example, we try to identify crypto loops, functions wich calls sensitive API (file, process, network, ...)

  • Peinfo : We load the PE metadata with the peinfo library.

  • Strings : extract ASCII and Unicode strings

Signatures

We use several signature models to classify malware:

  • Yara
  • imphash
  • Machoc

Machoc

Machoc is a CFG-based algorithm to classify malware. For more informations, please refer to the following documentation:

IDA Collaboration: Skelenox

This is an IDAPython plugin, wich is used to synchronize the names and comments with the knowledge base, and with other users database

Contributing

Contributions are welcome, so please read CONTRIBUTING.md to have a quick start on how to get help or add features in Polichombr

Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].