Malware Sample OSINT Tools

MITRE ATT&CK

Adversary tactics and techniques knowledge base

VirusTotal

Analyze files, URLs, domains, and IPs

ANY.RUN

an interactive malware sandbox for analyzing suspicious files, URLs, and netw

APKLab

VSCode extension for Android RE workflow

Androbugs Framework

Android vulnerability scanner

Apktool

Android APK reverse-engineering toolkit

Autopsy

a digital forensics platform for investigating disk images, filesystems, and

CAPEv2

CAPE malware sandbox (Cuckoo fork)

Cuckoo Sandbox

Open-source automated malware sandbox

Cutter

Open-source GUI reverse-engineering tool

DRAKVUF Sandbox

Agentless Xen-based malware sandbox

Detect It Easy

Packer and signature detector for binaries

Drozer

Android security assessment framework

Exodus Privacy

Android APK tracker and permission scanner

FAME

Malware-analysis orchestration framework

FLOSS

a FLARE tool for extracting obfuscated strings from malware and suspicious bi

FileScan.io

OPSWAT free public file and URL sandbox

Frida

Cross-platform dynamic instrumentation toolkit

Ghidra

NSA open-source reverse-engineering suite

Hatching Triage

a malware sandbox for analyzing files, URLs, configurations, and behavioral i

Hybrid Analysis

a malware analysis platform that runs files and URLs in sandbox environments

Imunify360 Sandbox

Palo Alto WildFire malware analysis portal

Intezer Analyze

a malware analysis platform that classifies files, code reuse, and threat rel

Joe Sandbox

a malware analysis sandbox for dynamic and static investigation of files, URL

Jotti's malware scan

Scans an uploaded file with multiple antivirus engines

Koodous

Android malware intelligence platform

Malpedia

Malware-family encyclopedia with YARA rules and actor links

MalwareBazaar

an abuse.ch malware sample exchange for searching hashes, tags, families, and

MobSF

Open-source mobile app security framework

Mobile Verification Toolkit

a mobile forensics toolkit for checking Android and iOS devices for compromis

OWASP Mobile Security Testing Guide

OWASP mobile app security testing guide

Objection

Frida-based mobile exploration toolkit

Polyswarm

Decentralized multi-engine TI marketplace

Quark Engine

Android malware threat scoring engine

Rizin

Maintained fork of radare2

URLhaus

an abuse.ch project tracking malware URLs, payload delivery sites, and relate

UnpacMe

Automatically unpack malware samples and extract payloads

VMRay

Hypervisor-based malware sandbox producing IOC reports

Volatility 3

a memory forensics framework for analyzing volatile memory images and artifac

YARA

a pattern matching engine for identifying malware families and binary artifac

YARAify

Community YARA hunting service

capa

a FLARE tool that detects capabilities in executables using static analysis r

jadx

Java and Android APK decompiler

pestudio

Windows PE static-analysis triage tool

radare2

Open-source reverse-engineering framework