ToolWar | Information Security (InfoSec) Tools: Malware

Malheur (Automatic Analysis of Malware Behavior) :: Tools

<div dir="ltr" style="text-align: left;" trbidi="on">
<div style="text-align: justify;">
<br /></div>
<div class="separator" style="clear: both; text-align: center;">
<img alt="Malheur Logo" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhNYaQVbdOpGxMX0IyRR5o5yFrLFh615Tr9uwYiY4Q2EirUJUl_W-ePiFVBpcotviuNqU532PahMPgwtLUXwa6BIcd-l5vvv4-ii4c1X34WzQg1WIG455HICfHdxFvuWI1YEJ1JGAE3BxfN/s1600/malheur_logo.png" title="Malheur Logo" /></div>
<div style="text-align: justify;">
<b>Malheur</b> is a tool for the <i>Automatic Analysis of Malware Behavior</i> 
   (program behavior recorded from malicious software in a sandbox
   environment). It has been designed to support the regular analysis of
   malicious software and the development of detection and defense measures. <b>
   Malheur</b> allows for identifying novel classes of malware with similar
   behavior and assigning unknown malware to discovered classes.</div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
<b>Analysis of malware behavior?</b></div>
<div style="text-align: justify;">
<b>Malheur</b> builds on the concept of <i>dynamic analysis</i>:
 Malware binaries are collected in the wild and executed in a sandbox,
 where their behavior is monitored during run-time. The execution of
 each malware binary results in a report of recorded behavior. Malheur
 analyzes these reports for discovery and discrimination of malware
 classes using <i>machine learning</i>.
 </div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
Malheur can be applied to recorded behavior of various format, as
   long as monitored events are separated by delimiter symbols, for
   example as in reports generated by the popular malware sandboxes
    CWSandbox,
    Anubis,
    Norman Sandbox and 
    Joebox. </div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
<b>Tutorial ::</b> http://www.mlsec.org/malheur/examples.html </div>
<div style="text-align: justify;">
<b>Download Here :: </b><a href="http://www.mlsec.org/malheur/files/malheur-0.5.3.tar.gz" target="_blank">Malhuer-0.5.3</a> (Linux)</div>
<div style="text-align: justify;">
<b>Official Website ::</b> http://www.mlsec.org/</div>
</div>

Malheur (Automatic Analysis of Malware Behavior) :: Tools

Malheur is a tool for the Automatic Analysis of Malware Behavior (program behavior recorded from malicious software in a sandbox...

Revenssis (Penetration Testing Suite for Android Devices) :: Tools

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
 <img alt="revenssis logo toolwar" border="0" height="320" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg5akPP1gYogJsMY0bpiMUplwpdcoAnNdS8L6KM7gDgc3SKxos7q-Nq9vqTkjw6087MYguSsXpZd_73Azac59n9vrG46CPIYY881-rMZxH42vQUcK0mtCLM0EZlZuMtE4t2Owqa8liUPc55/s320/revenssis+logo+toolwar.jpg" title="revenssis logo toolwar" width="213" /></div>
<div style="text-align: justify;">
<b>Revenssis</b> is a complete <i>Penetration testing suite for Android devices</i>. Nicknamed as the "Smartphone Version of Backtrack", Revenssis  Penetration Suite is a set of all the useful types of tools used in  Computer and Web Application security. Tools available in it include:  Web App scanners, Encode/Decode & Hashing tools, Vulnerability  Research Lab, Forensics Lab, plus the must-have utilities (Shell, SSH,  DNS/WHOIS Lookup, Traceroute, Port Scanner, Spam DB Lookup, Netstat...  etc). All these fitting in an application approx. 10MB (post  installation). </div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
<b>Download Here ::</b> <a href="http://revenssis-penetration-testing-suite.googlecode.com/files/Revenssis.apk" target="_blank">Revenssis.apk</a> & (Available at Play Store)</div>
<div style="text-align: justify;">
<b>Source ::</b> http://code.google.com/p/revenssis-penetration-testing-suite/</div>
</div>

Revenssis (Penetration Testing Suite for Android Devices) :: Tools

Revenssis is a complete Penetration testing suite for Android devices . Nicknamed as the "Smartphone Version of Backtrack",...

Yara (Malware Identification and Classification) :: Tools

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<img alt="yara logo toolwar" border="0" height="200" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjKAYkHKynInHb6UvL_uNSYygzssfvA8Usl6A5CEKTElTLxrhw14_GJ2R_-QH8rkImx08HK67pJi4trQH6Osr7rRBGdHk631OfVQLHOgusXNlZKrc_EdCURJUhlOA8pc3i1axVRFoAyaLpH/s200/yara+logo+toolwar.png" title="yara logo toolwar" width="180" /></div>
<div style="text-align: justify;">
<b>YARA</b> is a tool aimed at helping malware researchers to identify and  classify malware  samples. With <b>YARA</b> you can create descriptions of  malware families based on textual or  binary patterns contained on  samples of those families. Each description consists of a set of strings  and a Boolean expression which determines its logic.</div>
<div style="text-align: justify;">
This is just a simple example, more complex and powerful rules can be  created by using binary strings with wild-cards, case-insensitive text  strings, special operators, regular expressions and many other features  that you can find explained in <b>YARA's </b>documentation. </div>
<div style="text-align: justify;">
<b>YARA</b>  is multi-platform, running on Windows, Linux and Mac OS X, and can be  used through its command-line interface or from your own Python scripts  with the yara-python extension.  </div>
<div style="text-align: justify;">
Python users can also use yara-ctypes  by Michael Dorman. He has also written a multi-threaded command-line  YARA scanner based on yara-ctypes that can exploit the benefits of  current multi-core CPUs when scanning big file collections. </div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
<div class="separator" style="clear: both; text-align: center;">
<iframe allowfullscreen="allowfullscreen" frameborder="0" height="266" mozallowfullscreen="mozallowfullscreen" src="https://www.youtube.com/embed/JyS3bnGBErw?feature=player_embedded" webkitallowfullscreen="webkitallowfullscreen" width="320"></iframe></div>
</div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
<br />
<b>Download Here ::</b> <a href="http://yara-project.googlecode.com/files/yara-1.7.tar.gz" target="_blank">Yara 1.7.tar.gz</a> (for Linux)<br />
                               <a href="http://yara-project.googlecode.com/files/yara-1.7-win32.zip" target="_blank">Yara 1.7 win32.zip</a> (for Windows)</div>
<div style="text-align: justify;">
<b>Source :: </b>http://code.google.com/p/yara-project/ </div>
</div>

Yara (Malware Identification and Classification) :: Tools

YARA is a tool aimed at helping malware researchers to identify and classify malware samples. With YARA you can create descriptions ...