This repository is a curated collection of threat intelligence indicators of compromise (IOCs) published by ESET Research. It contains structured data for hundreds of malware families and APT campaigns, including file hashes (MD5, SHA1, SHA256), network indicators (domains, IPs, URLs), host-based artifacts (registry keys, file paths, mutexes), and detection rules (YARA, Sigma, Snort). The data is organized per-threat in consistent directory structures with README.adoc documentation, MISP event JSON exports, and plain hash lists. The repository serves as a reference for threat hunters, SOC analysts, and security researchers to detect and investigate known threats. While the data is static and time-sensitive, the detection rules and structured IOC formats are directly reusable in security tools and platforms.
androidqf is a Go-based Android forensic data acquisition tool designed to collect various types of data from an Android device via ADB. The tool automates the gathering of device properties, system logs, running processes, services, settings, diagnostic information, installed applications (with optional APK extraction), and device backups. It stores the collected data in a timestamped directory and optionally encrypts and compresses the archive using age encryption if a public key is provided. The application follows a modular architecture where each data collection task is implemented as a separate module adhering to a common interface. The core components include a cross-platform ADB wrapper that automatically deploys platform-specific binaries, an asset embedding mechanism for distributing native dependencies, and an acquisition manager that handles the lifecycle of data collection and secure storage. The tool interacts with the device through ADB commands, collects data into structured files and directories, and provides user prompts for configurable options such as backup scope and APK selection. Despite the README indicating the project is not maintained, the repository shows recent commit activity and the codebase demonstrates solid engineering practices. Dependencies are up to date, and the tool is built for cross-platform use (Windows, macOS, Linux) with automated build and release workflows. The modular design allows for extensibility, and the reusable components (such as the ADB wrapper and asset deployment) could be adapted for other projects requiring Android device interaction.
This repository, branded as "The Malware Bible," is a curated educational knowledge base for cybersecurity, malware analysis, reverse engineering, and exploit development. It is not a conventional software application or an operational data pipeline; under the available classifications it is closest to data/research because its core assets are reference documentation, course-style Markdown modules, and research-oriented binaries rather than runnable application code. The content is organized into four learning paths: The Beginning (C, Python, x86 assembly, shellcode, reverse engineering basics), The Journey (PE/ELF structures, Android/iOS package formats), The Rituals (obfuscation, evasion, and writing malware), and The Scriptures (tool cheatsheets for radare2, IDA Pro, WinDbg, YARA, WinAPI, and evasion tactics). In practice, the repository serves as a self-study curriculum and analyst reference, not as a deployable system. It includes a large Windows DLL export catalog in Markdown, example ELF binaries demonstrating heap overflow, use-after-free, ROP chains and format string bugs, and numerous screenshots/diagrams. There is no CI/CD, dependency management, or automated testing; several files are marked "Coming soon" or "WORK IN PROGRESS," and external links or sponsor images may rot over time. The Windows API and DLL reference content is broad but may drift as Windows evolves. The last commit is recent, indicating active maintenance, and the repository benefits from a structured table of contents and consistent formatting across chapters.
This repository is a static data collection of malware indicators of compromise (IOCs) organized by APT threat actor. It contains no application code, scripts, or executable logic; the content is entirely markdown files, each holding a consistent five-column table (Hash, Type, Family, First_Seen, Name) with VirusTotal links. The data spans roughly 2007-2025 and covers file types including PE executables, documents, Android APKs, ELF binaries, and LNK files. The directory structure groups hashes by actor, making the markdown tables the primary entry points for IOC lookup or ingestion.
GoPhantom is a Go-based Windows loader generator designed for security research. It creates executables that embed and decrypt payloads and decoy files while employing various evasion techniques to avoid detection. The application takes input files (decoy and payload), encrypts them, generates Go source code using templates that incorporate the encrypted data and selected security features, then compiles this code for Windows/amd64. The resulting executable can showcase the decoy file to the user while executing the payload through techniques like process injection, API hashing, direct syscalls, memory protection evasion, and module stomping to make malicious code appear as legitimate DLL code. The project is explicitly archived and no longer actively developed, as stated in the README.