-
Network Analysis Tools
-
Wireshark
- Windows. MacOs, Linux
-
NetworkMiner
- Windows
-
Network Monitor
- Windows
-
Fiddler
- Windows
-
FakeNet
- Windows, Linux
-
INetSim
- Linux
-
ApateDNS
- Windows
- Free
-
Reverse Engineering Tools
-
IDA
-
Windows
- Windows
-
Cutter
- Windows
-
Radare
- Linux
-
Ghidra
- All Os Patform
- Free
- Paid/Free
-
Yara Tools
- Yara
- Yara Doc
- Yara Gen
- Free
-
Dynamic Analysis Tools
-
Sysinternals
- Windows
-
Process Hacker
- Windows
-
NirSoft
- Windows
-
RegRipper
- Windows
-
Regshot
- Windows
-
Resource Hacker
- Windows
-
HxD
- Windows
-
Sysanalyzer
- Windows
-
Winaudit
- Windows
-
Capturebat
- Windows
-
Object-See
- MacOs
- Free
-
Memory Analysis Tools
-
Volatility
- Windows, MacOS, Linux
-
Rekall
- Windows, MacOS, Linux
-
Redline
- Widows
- Free
-
APT's Reference:
- Attack Mitre
- Threat Actor Encyclopedia
- Cyber Research
- ATP Google Sheet
- FireEye
- CyberMonitor
- Florian Roth
- MalPedia
- Threat Actor Encyclopedia V 2.0
- A Threat Actor Encyclopedia
- APT_Digital_Weapon
- Contains Malware Samples
-
Threat Hunting
-
Threat Hunting Reference
- Attack&Ck
- The ThreatHunting Project
- HUNTPEDIA
-
Threat Hunting Practical Activities
- EVTX-ATTACK-SAMPLES
- Atomic Red Team
- ThreatHunt
- RedHunt OS
- Red Team Automation (RTA)
- CALDERA™
- PowershellEmpire
-
Threat Hunitng Videos
- Adrian Crenshaw
- SANS Threat Hunting Summit 2017
- SANS Threat Hunting Summit 2016
- Toppling the Stack
- James Bower
- Red Canary
-
Threat Hunting Tools
- ELK
- HELK
- Sysmon
- Osquery
- ThreatPursuit VM
- Free
-
Threat Hunting Course
- Cyber Threat Hunting by FireEye
- Incident Response and Threat Hunting By SANS
- Practical Threat Hunting
- Adversary Tactics: Detection by SpecterOps
- Adversary Tactics: PowerShell by SpecterOps
- Advanced Threat Tactics – Course and Notes
- Paid
- Free
-
LOLBAS/GTFOBins
- LOLBAS
- GTFOBins
-
Threat Hunting Blogposts
- Red Teaming Experiments
- MITRE & ATT&CK
- RedCanary
- RedCanary Case Studies
- Uptycs Blog
-
Malware Samples
-
VirusBay
-
Registration
- support@virusbay.io
-
Malpedia
-
Registration
- daniel.plohmann@fkie.fraunhofer.de
-
Malshare
- Registration
-
TheZoo
- No
-
VirusShare
-
Registration
- admin@virusshare.com
-
VX Vault
- Registration
-
Cyber Tracker
- No
-
Virus Sign
- Registration
-
Malware Traffic Analysis
- No
-
Contagio
- No
-
APT-Sample
- No
-
LOLBAN Samples
- No
-
Tracker.VirusShare
- No
-
MalwareBazzar
- Registration
- Contains Malware Samples
-
Books:
- Practical Malware Analysis
- Learning Malware Analysis
- Malware Analysis and Detection Engineering
- Mastering Malware Analysis
- Practical Reverse Engineering
- The Art of Memory Forensics
- Windows Internals, Part 1
- The IDA Pro Book, 2nd Edition
- Reverse Engineering for Beginners
- Paid
- Free
-
CTF's
- Flare-On Challenge
- Join ESET
- Beginner Malware Reversing Challenges
- Reverse Engineering challenges
- 0x00sec
- CTF Field Guide
- MemLabs
-
Portable Executable [PE] Analysis Tools
-
PE Bear
- Windows
-
PortEx
- Windows
-
Manalyze
- Windows
-
PE Studio
- Windows
-
Mastiff
- Windows
-
Exeinfo PE
- Windows
-
CFF Explorer
- Windows
-
PE Tools
- Windows
-
FileAlyzer
- Windows
-
PE Explorer
- Windows
-
PE Insider
- Windows
-
PE View
- Windows
-
Chimprec
- Windows
-
PEID
- Windows
-
DIE
- Windows. MacOs, Linux
- Free
-
File Carving Tools
-
Bulk Extractor
- Linux, MacOs
-
EVTXtract
- Windows
-
Foremost
- Linux, MacOs
-
Hachiir3
- All Os Patform
- Free
-
Twitter Handle to follow
- Cyb3rops
- Fs0c131y
- Hasherezade
- Herrcore
- Lenny Zeltser
- LiveOverflow
- Malware Unicorn
- MalwareTech
- Ophir Harpaz
- Samir
- Sean
- USCYBERCOM Malware Alert
- MalwareHunterTeam
- Shadow Chaser Group
- vx-underground
-
YouTube Channel for Malware Analysis
- OALabs
- Kindred Security
- Colin Hardy
- MalwareAnalysisForHedgehogs
- Michael Gillespie
- ReverseIT
- LiveOverflow
- hasherezade
- John Hammond
- MalwareTech
- RSA Conferenc
- Active Channels
-
Online Sandbox
-
Malpedia
-
Registration
- All os platform
-
Joe SandBox
-
No
- All os platform, Url analyze
-
MalwareBazzar
-
Yes
- Document Analyzer, File Analyze
-
Hybrid Analysis
-
Yes
- All os platform, Url analyze
-
Any Run
-
User Preference
- All os platform, Url analyze
-
Yomi
-
Yes
- Document Analyzer, File Analyze
-
Hatching
-
Yes
- All os platform, Url analyze
-
Cuckoo
-
No
- All os platform, Url analyze
-
Sndbox
-
Yes
- All os platform, Url analyze
-
Virus Total
-
User Preference
- All os platform, Url analyze
-
UrlScan
-
User Preference
- Url analyze
-
Checkphish
-
User Preference
- Url analyze
-
Url Void
-
No
- Url analyze
-
TotalHash
-
No
- Hash Analyzer, IP Analyzer, Domain Analyzer
-
Intezer
-
Yes
- All os platform
-
Maltiverse
-
Yes
- IOC Search engine
- Malware Sample can download
-
Memory Acquisition Tools
-
Redline
- Widows
-
Belkasoft
- Widows
-
Magnet
- Widows
-
Ftk Imager
- Windows, MacOS
-
Dumpit
- Widows
-
LiME
- Linux
- Free
-
Deobfuscation Tools
- Decalage
- De4dot
- Floss
- PackerAttacker
- Unpaker
- VirtualDeobfuscator
- XORSearch & XORStrings
- Unpca.Me
- Free
- Registration
-
Classes/Labs
- PracticalMalwareAnalysis-Labs
- Reverse Engineering 101
- Intro to x86
- Intro to x86-64
- Malware Dynamic Analysis
- Introduction To Software Exploits
- Intermediate Intel x86
- Reverse Engineering Malware
- RPISEC
- Reverse Engineering 101 Speaker Presentation
- Reverse Engineering 101 NYU:Poly 2010 (Day 1)
- Reverse Engineering 101 NYU:Poly 2010 (Day 2)
- Reverse Engineering for Beginners
- Malware Analysis
- Reverse Engineering for Beginners
- Malware Analysis - CSCI 4976
- Max Kersten
- Free
-
Document Analysis Tools
- Ole Tool
- Didier's PDF Tools
- Origami
-
REMnux
- Linux Virtual OS
- PDF
- ViperMonkey
- Free
-
Disassembler Tools
-
X64
- Widows
-
OllyDbg
- Widows
-
ILSpy
- Widows
-
DNSpy
- Widows
-
GDB
- All Os Platform
-
Binary Ninja
- All Os Platform
-
Qira
- Linux
- Free
-
Offline Sanbox
-
Cuckoo
-
All Os Platform
- Document Analyzer, File Analyzer
-
Limone
-
Widows
- Document Analyzer, File Analyzer, Memory Analyzer
-
Noriben
-
Widows
- Document Analyzer, File Analyzer
-
Assemblyline 4
-
Widows
- Document Analyzer, File Analyzer
- Free
-
Malware Analysis Course
- Malware Analysis Master Course
- FOR610
- Malware Analysis Mindset Training
- Reversing & Malware Analysis Training
- Advanced Malware Analysis Training
- Paid
- Free
-
Threat Intelligence/ RSS Feeds
- badips.com
- bambenekconsulting for domain
- bambenekconsulting for IP
- blocklist
- blocklistnetua
- botvrij for domain
- botvrij for IP
- charlesthehaleys
- CiArmy.com
- cinsscore
- cybercrimetracker
- dan_me
- danger.rulez.sk
- disconnect.me
- dshield.org
- dydns
- emergingthreats for botcc
- fedotracker
- greensnow
- h3xtracker
- hphosts for malware
- iblocklist
- ibmxforce
- intercept.sh
- intercept.sh
- malc0de
- malware_traffic
- malwared.malwaremustdie.org
- malwaredomainlist
- openphish
- phishtank
- botherder
- stamparm
- report.cs.rutgers.edu
- rules.emergingthreats.net
- sslbl.abuse.ch
- threatsourcingdomain
- threatsourcingip
- torstatus
- urlhaus
- urlvir IP
- urlvir Host
- vxvault
- whoisds
- www.binarydefense.com
- zerodot for Domain
- zerodot for IP
- Free/Online
-
Virtual Machines (VMs)
-
Virtual Environment
- Windows
-
OsBoxes
-
Linux
- username is 'osboxes.org' and the password is 'osboxes.org'.
-
Flare VM (FireEye)
- Windows
-
OA Labs VM
- Windows
-
REMnux
- Linux
-
Detection Lab
- Windows
-
Reverse Engineer's Toolkit
- Windows
- Free
-
Scripts
-
AnalysisScipt
- Python
-
Malware Analysisi Scripts
- Python
-
Malware-Analysisi
- C, IDA, Python, Ruby, Yara
-
MAUPS
- Python
-
VirusTotal_API_Tool
- Python
-
FindYara
- Python, IDA
-
IR TI Scripts
- Python
-
Hasherezade
- Tools
-
Florian Roth
- Python, Yara, Tools
- Free
-
Honeypot Reference
-
Conpot
- ICS/SCADA honeypot.
-
Cowrie
- SSH honeypot based on Kippo.
-
DemoHunter
- Low interaction Distributed Honeypots.
-
Dionaea
- Honeypot designed to trap malware.
-
Glastopf
- Web application honeypot.
-
Honeyd
- Create a virtual honeynet.
-
HoneyDrive
- Honeypot bundle Linux distro.
-
Honeytrap
- Opensource system for running monitoring and managing honeypots.
-
MHN
- Centralized server for management and data collection of honeypots.
-
Mnemosyne
- A normalizer for honeypot data; supports Dionaea.
- Thug
- Free
- By Shilpesh Trivedi