MalwareAnalysisSeries

KO | EN

gitlite — search

#javascript #hacktoberfest #react #golang #rust #deep-learning #macos #nodejs #java #security #pytorch #mcp #openai #open-source

MalwareAnalysisSeries

(★ 26)

This repository contains the analysis reports, technical details or any tools created for helping in malware analysis. Additionally, the repo contains extracted TTPs with code along with the detection rules

MalwareAnalysisSeries 최신버젼 다운로드

최종 버전 다운로드 (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

<div align="center">
  <img width="900px" src="Assets/Mal_series.jpg" alt="Malware Analysis Series — reverse engineer, understand, detect, defend" />
  <h1>MalwareAnalysisSeries</h1>
  <br />  
</div>

Welcome to the MalwareAnalysisSeries repository, your go-to destination for highly refined analysis reports, useful reverse engineering tools & scripts, unpacked malware stages, extracted TTPs and its development. This open-source pet project is dedicated to dissecting infamous malware families, offering deep technical insights assisting in advance analysis and reverse engineering. The process of malware development is also covered in this repository as each significant TTP is recreated in exact way as the actual malware.

## Purpose
The primary goal of MalwareAnalysisSeries is to provide a comprehensive resource for cybersecurity enthusiasts, researchers, and professionals alike. By delving into the intricate workings of prominent malware families, my aim is to empower the community with invaluable knowledge and tools to enhance their understanding of cybersecurity threats and bolster defense mechanisms.

## Whoami
<table style="border-collapse: collapse; border: none;">
  <tr style="border: none;">
    <td style="vertical-align: top; border: none;">
      <img src="Assets/modern_ida101.GIF" alt="Small Image" width="100" height="100" style="margin-right: 20px;">
    </td>
    <td style="vertical-align: top; border: none;">
      <p><a href="https://www.linkedin.com/in/shayan-ahmed-khan-517168120/">Shayan Ahmed Khan</a> <br> @shaddy43 <br> Threat Researcher | Detection & Response | MalDev <br> <a href="https://www.credly.com/badges/45a3ba35-3e34-4f94-bf47-bfde08b48de0/public_url">GREM</a>, <a href="https://learn.microsoft.com/en-gb/users/shayanahmedkhan-2672/credentials/92d6bb32e0ae540e">SC-200</a>, <a href="https://learn.microsoft.com/en-gb/users/shayanahmedkhan-2672/credentials/c4fac587e902016b">AZ-500</a>, <a href="https://www.credential.net/ff7a6f07-4c09-4d96-ab14-261b0d3f473a#gs.9t6ecb">PMRP</a>, HCIA Security <br> I believe in <a href="https://medium.com/@shaddy43">open-source</a> work & contributions!
      </p>
    </td>
  </tr>
</table>

## Malware Analysis Repositories
<table>
  <thead>
    <tr>
      <th>Title</th>
      <th>Description</th>
    </tr>
  </thead>
  <tbody>
    <tr>
      <td><a href="AI-Assisted-Reversing">AI-Assisted-Reversing</a></td>
      <td>Evaluating an AI agent driving Ghidra over MCP against BrowserSnatch, Ryuk and Xloader 4.3</td>
    </tr>
    <tr>
      <td><a href="CrackedHaven">CrackedHaven</a></td>
      <td>Understand Software Cracking and its Implications</td>
    </tr>
    <tr>
      <td><a href="MedusaLocker">MedusaLocker</a></td>
      <td>Technical Analysis & TTPs of MedusaLocker Ransomware</td>
    </tr>
    <tr>
      <td><a href="NanoCore1.2.2.0">NanoCore1.2.2.0</a></td>
      <td>Technical Analysis & TTPs of NanoCore RAT 1.2.2.0</td>
    </tr>
    <tr>
      <td><a href="Ryuk">Ryuk</a></td>
      <td>Technical Analysis & TTPs of Ryuk Ransomware</td>
    </tr>
    <tr>
      <td><a href="Xloader4.3">Xloader4.3</a></td>
      <td>Technical Analysis & TTPs of Xloader AKA Formbook 4.3 Infostealer</td>
    </tr>
    <tr>
      <td><a href="Emotet">Emotet</a></td>
      <td>Technical Analysis of Emotet Malware</td>
    </tr>
  </tbody>
</table>

## Repository Structure Overview

| **Directory** | **Description** |
|---------------|-----------------|
| [**`://Malware/`**] | Contains all malware-related content. Reports/Articles etc |
| [**`://Malware/sample/`**] | Repository of malware samples and their unpacked stages. |
| [**`://Malware/tools_and_scripts/`**] | Collection of tools and scripts used in malware analysis. |
| [**`://Malware/Extracted_TTPs/`**] | Directory containing the Tactics, Techniques, and Procedures (TTPs) identified in the malware and its code recreated after analysis |
| [**`://Malware/Extracted_TTPs/TTP(1...n)/Detection`**] | Specific detection rules associated with each TTP extracted from the malware. |
| [**`://Assets/`**] | Stores visual aids, including images, videos, and GIFs, used in reports and documentation. |

## Visualized Structure

```plaintext
MalwareAnalysisSeries/
├── Malware/
│   ├── sample/
│   ├── tools_and_scripts/
│   ├── Extracted_TTPs/
│   │   ├── TTP1/
│   │   │   ├── Code/
│   │   │   └── Detection/
│   │   ├── TTP2/
│   │   │   ├── Code/
│   │   │   └── Detection/
│   │   └── ...
│   └── Assets/
├── ...
├── Assets/
└── README.md
```

## MITRE ATT&CK Coverage

Every recreated TTP is mapped to the [MITRE ATT&CK](https://attack.mitre.org/) framework. The matrix below covers the techniques that currently ship recreated code, and whether a detection artifact accompanies them. For the full picture — every technique observed across all families, grouped by tactic — see the [ATT&CK coverage matrix](https://shaddy43.github.io/MalwareAnalysisSeries/attack/).

| Technique | ID | Tactic | Family | Code | Detection |
|-----------|----|--------|--------|:----:|:---------:|
| Scheduled Task/Job: Scheduled Task | [T1053.005](https://attack.mitre.org/techniques/T1053/005/) | Persistence / Priv. Esc. | MedusaLocker, NanoCore | ✅ | ✅ |
| Impair Defenses: Disable or Modify Tools | [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Defense Evasion | MedusaLocker, NanoCore | ✅ | ✅ |
| Data Encrypted for Impact | [T1486](https://attack.mitre.org/techniques/T1486/) | Impact | MedusaLocker, Ryuk | ✅ | ⚠️ |
| Service Stop | [T1489](https://attack.mitre.org/techniques/T1489/) | Impact | MedusaLocker | ✅ | ✅ |
| Inhibit System Recovery | [T1490](https://attack.mitre.org/techniques/T1490/) | Impact | MedusaLocker | ✅ | ✅ |
| Network Share Discovery | [T1135](https://attack.mitre.org/techniques/T1135/) | Discovery | MedusaLocker | ✅ | ✅ |
| Input Capture: Keylogging | [T1056.001](https://attack.mitre.org/techniques/T1056/001/) | Credential Access | NanoCore | ✅ | ✅ |
| Boot/Logon Autostart: Registry Run Keys | [T1547.001](https://attack.mitre.org/techniques/T1547/001/) | Persistence | NanoCore | ✅ | ✅ |
| Clipboard Data | [T1115](https://attack.mitre.org/techniques/T1115/) | Collection | NanoCore | ✅ | ✅ |
| Data from Local System | [T1005](https://attack.mitre.org/techniques/T1005/) | Collection | NanoCore | ✅ | ✅ |
| Subvert Trust Controls: Mark-of-the-Web Bypass | [T1553.005](https://attack.mitre.org/techniques/T1553/005/) | Defense Evasion | NanoCore | ✅ | ✅ |
| Process Injection: Process Hollowing | [T1055.012](https://attack.mitre.org/techniques/T1055/012/) | Defense Evasion | NanoCore | ✅ | ✅ |
| Obfuscated Files: Software Packing | [T1027.002](https://attack.mitre.org/techniques/T1027/002/) | Defense Evasion | NanoCore, Xloader | ✅ | ⚠️ |
| Obfuscated Files: Encrypted/Encoded File | [T1027.013](https://attack.mitre.org/techniques/T1027/013/) | Defense Evasion | Xloader | ✅ | ❌ |
| Non-Application Layer Protocol | [T1095](https://attack.mitre.org/techniques/T1095/) | Command & Control | NanoCore | ↗ | ✅ |
| Abuse Elevation Control: Bypass UAC | [T1548.002](https://attack.mitre.org/techniques/T1548/002/) | Priv. Esc. / Defense Evasion | MedusaLocker | ↗ | ✅ |

Legend: ✅ available &nbsp;•&nbsp; ⚠️ partial &nbsp;•&nbsp; ↗ external reference, credited on the family page &nbsp;•&nbsp; ❌ not yet available (contributions welcome — see [CONTRIBUTING.md](CONTRIBUTING.md)).

## Tooling

The analyses in this repository were produced with the following tools, listed here as a reference for anyone reproducing the work:

- **Disassemblers / decompilers:** IDA Pro, Ghidra, dnSpy / dnSpyEx (.NET)
- **Debuggers:** x64dbg / x32dbg, WinDbg, Visual Studio Debugger (VBS/managed)
- **Dynamic analysis:** REMnux, FLARE-VM, Process Hacker, Process Monitor, Wireshark, INetSim
- **Unpacking / triage:** PE-bear, CFF Explorer, Detect It Easy (DIE), YARA
- **Custom helpers:** see each module's `tools_and_scripts/` directory

## Safe Handling

This repository contains **live malware samples and functional offensive code**. Handle it responsibly:

- All samples are stored in password-protected archives — the password is `infected`.
- **Only** detonate or unpack samples inside an isolated, network-controlled virtual machine with no access to production data or credentials.
- Never run any binary from this repository on a host you cannot afford to lose or re-image.
- See [SECURITY.md](SECURITY.md) for the full handling policy and how to report an issue.

## Disclaimer
It's important to emphasize that MalwareAnalysisSeries is intended strictly for educational and research purposes. I do not condone or support any form of malicious activity. The tools, scripts, and analysis reports provided here are meant to foster learning, enhance cybersecurity knowledge, and contribute to the collective defense against cyber threats. Any misuse or illegitimate use of the content within this repository is strongly discouraged and goes against the principles of ethical cybersecurity practices.

Join me in this mission to dissect, understand, and combat malware. Together, we can make cyberspace a safer environment for all.

MalwareAnalysisSeries

MalwareAnalysisSeries 최신버젼 다운로드

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

MalwareAnalysisSeries

MalwareAnalysisSeries 최신버젼 다운로드

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

Download README