Threat-Intelligence-Analyst

威胁情报，恶意样本分析，自动化python脚本，开源Malware代码收集,APT攻击安例相关

TI威胁情报

Analyzing Malicious Password Protected Office Documents

https://r3mrum.wordpress.com/2017/06/29/analyzing-malicious-password-protected-office-documents/

Hack

https://github.com/Hack-with-Github/Awesome-Hacking

恶意软件分析大合集

https://github.com/rshipp/awesome-malware-analysis
https://github.com/wtsxDev/Malware-Analysis
https://github.com/CHYbeta/Software-Security-Learning

LifeOfBinarie

http://www.opensecuritytraining.info/LifeOfBinaries.html

PNG Payload

https://www.anquanke.com/post/id/166451

Malware Sample Source

https://zeltser.com/malware-sample-sources/

Malware Analyst

https://pastebin.com/QXURDzmA

Malware分析文章

http://reversingminds-blog.logdown.com/
https://cysinfo.com/category/training/malware-analysis/

恶意样本分析

http://blog.nsfocus.net/malware-sample-analysis-summary/

Resources for Learning Reverse Engineering

http://jackson-t.ca/re-resources.html

病毒分类

https://www.virusradar.com/en/glossary

在线检测恶意软件网站

https://www.hybrid-analysis.com/
https://www.virustotal.com/#/home/upload
https://www.reverse.it/
https://www.maldun.com/submit/submit_file/
https://habo.qq.com/
https://www.joesandbox.com/
https://virusscan.jotti.org/
http://www.threatexpert.com/submit.aspx
http://virscan.org/
https://any.run/
https://id-ransomware.malwarehunterteam.com/
https://www.vmray.com

用命令行与Python使用YARA规则-识别恶意木马必备

https://bbs.pediy.com/thread-223070.htm

ida视频

http://hdvidzpro.pro/video/ida-tutorial

恶意样本分析

https://secrary.com/ReversingMalware/CoinMiner/
https://secrary.com/ReversingMalware
https://secrary.com/ReversingMalware/Upatre/
https://secrary.com/ReversingMalware/Mamba/
https://secrary.com/ReversingMalware/UnpackingShade/
https://secrary.com/ReversingMalware/Enosch/
https://www.anquanke.com/post/id/87172
http://blog.talosintelligence.com/2017/11/zeus-panda-campaign.html

Malware Sample Sources for Researchers

https://zeltser.com/malware-sample-sources/

List of Malware Sources

http://www.kernelmode.info/forum/viewtopic.php?f=16&t=308

WMI BackDoor

https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/

IDA

http://kingerwu.com/2017/12/16/IDA%E6%93%8D%E4%BD%9C%E7%9F%A5%E8%AF%86%E8%AE%B0%E5%BD%95/#more

malware analysis labs

https://cybersecweb.wordpress.com/2016/07/12/malware-analysis-labs/

Exploitation Archives

https://rootkits.xyz/blog/tag/exploitation/

Exploits

https://0xrick.github.io/binary-exploitation/bof2/

VMP/TMD Unpack

OD调试过VMProtect虚拟机检测教程
https://www.52pojie.cn/thread-411742-1-1.html

TMD壳的脱壳（可能是2.1.8）
https://www.52pojie.cn/thread-675279-1-1.html

VMP v3.0.9过VMware检测
https://www.52pojie.cn/thread-635613-1-4.html

分析一个新型VM的CrackMe
https://www.52pojie.cn/thread-695729-1-1.html

MIPS 路由器木马

http://www.freebuf.com/articles/network/88798.html

勒索软件信息

https://www.botfrei.de/de/ransomware/galerie.html

Linux Kernel Debug

https://bbs.pediy.com/thread-226139.htm

PowerShell

https://docs.microsoft.com/zh-cn/powershell/scripting/powershell-scripting?view=powershell-6

Limon Sandbox For Analyzing Linux Malwares

https://malware-unplugged.blogspot.com/2015/11/limon-sandbox-for-analyzing-linux.html
https://www.blackhat.com/docs/eu-15/materials/eu-15-KA-Automating-Linux-Malware-Analysis-Using-Limon-Sandbox-wp.pdf
https://www.youtube.com/watch?v=fSCKyF--tRs&feature=youtu.be

Advanced Malware Analysis

https://cysinfo.com/category/training/advanced-malware-analysis/

WMI POWERSHELL 挖矿

http://www.freebuf.com/articles/network/163233.html

CTF

http://eternalsakura13.com/2018/03/21/lctf2/

CoinMiner

Linux.挖矿.cpuminer方法记录
http://www.bubuko.com/infodetail-2167951.html

Compile CPUminer under Linux CentOS
https://rumorscity.com/2014/01/04/compile-and-install-cpuminer-on-linux-centos/

搭建Redis&Minerd安全应急演练环境
http://www.freebuf.com/sectool/156904.html

centos 6.3 64位下cpuminer +mining_proxy 挖掘莱特币（LTC）教程
https://www.cnblogs.com/sixiweb/archive/2013/12/02/3454564.html

coinotron
https://www.coinotron.com

NET Malware

https://blogs.cisco.com/security/talos/reversing-multilayer-net-malware

URL

https://urlhaus.abuse.ch/browse/

Yara

http://www.freebuf.com/articles/system/26373.html
https://github.com/plusvic/yara/releases/tag/v2.0.0
https://yara.readthedocs.io/en/v3.5.0/gettingstarted.html
https://analysis.yararules.com/
https://github.com/Yara-Rules/rules
https://www.bsk-consulting.de/2015/02/16/write-simple-sound-yara-rules/
https://www.bsk-consulting.de/2015/10/17/how-to-write-simple-but-sound-yara-rules-part-2/
https://www.bsk-consulting.de/2016/04/15/how-to-write-simple-but-sound-yara-rules-part-3/

教你构建自己的yara数据库

http://blog.safedog.cn/?p=281

基础反调试技术总结

https://bbs.pediy.com/thread-212371.htm

ARM Exploit

http://www.freebuf.com/articles/terminal/107276.html

Linux下莱特币Litecoin挖矿教程
https://blog.linuxeye.cn/385.html

Linux 莱特币LTC CPU挖掘教程
http://www.iitshare.com/linux-litecoin-ltc-mining-tutorial.html

以太坊Linux系统挖矿教程
http://www.8btc.com/gpu-mining

莱特币ltc挖矿教程:cpu挖矿与gpu挖矿(详细图文)
http://www.mnw.cn/news/digi/699354.html

勒索软件分析报告

File-Locker Ransomware
https://www.bleepingcomputer.com/news/security/file-locker-ransomware-targets-korean-victims-and-asks-for-50k-won/

层层抽丝——GlobeImposter勒索病毒分析
https://bbs.ichunqiu.com/thread-30152-1-1.html

轻轻脱掉你的衣--宏病毒的*姿势
https://bbs.ichunqiu.com/thread-29739-1-2.html

揭秘Chimera勒索软件
http://www.freebuf.com/articles/system/112142.html

初步分析勒索软件ZEPTO
http://www.freebuf.com/articles/system/112328.html

新型恶意勒索软件cuteRansomware
http://www.freebuf.com/news/109242.html

使用AES-256加密算法的勒索软件SkidLocker分析
http://www.freebuf.com/articles/terminal/99153.html

NanoLocker勒索软件的逆向分析
http://www.freebuf.com/articles/network/94595.html

新型恶意勒索软件DMA Locker分析
http://www.freebuf.com/articles/network/96738.html

locky勒索软件恶意样本分析2
http://www.ithtw.com/thread-8888.htm

locky勒索软件恶意样本分析1
http://blog.topsec.com.cn/ad_lab/locky%E5%8B%92%E7%B4%A2%E8%BD%AF%E4%BB%B6%E6%81%B6%E6%84%8F%E6%A0%B7%E6%9C%AC%E5%88%86%E6%9E%90/

IoT安全：调试环境搭建教程(AArch64篇)
https://bbs.pediy.com/thread-229581.htm

Docker分析文章

Docker恶意软件分析系列之初识Docker
http://blog.sina.com.cn/s/blog_e8e60bc00102vl37.html
Docker恶意软件分析系列II：客户端风险分析
http://blog.sina.com.cn/s/blog_e8e60bc00102vlq7.html
Docker恶意软件分析系列III：用viper分析APK和木马信息
http://blog.sina.com.cn/s/blog_e8e60bc00102vm2p.html
Docker恶意软件分析系列Ⅳ：js反混淆分析
http://blog.sina.com.cn/s/blog_e8e60bc00102vmwi.html
Docker恶意软件分析系列V：ALICTF决赛题目设计
http://blog.sina.com.cn/s/blog_e8e60bc00102vnr0.html
Docker恶意软件分析系列VI：ALICTF决赛解题思路
http://blog.sina.com.cn/s/blog_e8e60bc00102vnr6.html

Android 加固分析

https://paper.seebug.org/44/

MalwareVbr

https://0x4954.wordpress.com/2017/12/03/dfir-tips-malwarevbr-vm/

JS混淆

http://relentless-coding.org/projects/jsdetox/samples
http://www.freebuf.com/column/157281.html

BitCode

https://blockchain.info/

Processon

https://www.processon.com/

RTFOBJ

https://www.decalage.info/python/rtfobj

Python

https://awesome-python.com/

Linux Malware Analyst

http://blog.malwaremustdie.org/2016/11/linux-malware.html

Window Payload

http://www.freebuf.com/articles/system/156710.html

PowerShell

http://www.freebuf.com/articles/database/101267.html
http://www.freebuf.com/sectool/120675.html
http://www.freebuf.com/sectool/136328.html
http://www.freebuf.com/sectool/144824.html
http://www.freebuf.com/sectool/149835.html

PART 2A: INTRO TO THREAT HUNTING WITH KOLIDE FLEET, OSQUERY, POWERSHELL EMPIRE, AND CALDERA – SETUP ENVIRONMENT

https://holdmybeersecurity.com/2018/01/16/part-2a-intro-to-threat-hunting-with-kolide-fleet-osquery-powershell-empire-and-caldera-setup-environment/

R2

https://sec.xiaomi.com/article/30

Proxmox & Cuckoo

https://4d5a.re/proxmox-cuckoo-a-powerful-combo-for-your-home-malware-lab/

威胁情报网站

https://x.threatbook.cn/
https://ti.360.com/
https://www.threatminer.org/

恶意流量分析网站

http://www.malware-traffic-analysis.net

安全网站

https://quequero.org/

ML Malware

http://www.covert.io/the-definitive-security-datascience-and-machinelearning-guide/

看雪知识库

https://www.kanxue.com/chm.htm

NET逆向

https://www.anquanke.com/post/id/89730
https://www.anquanke.com/post/id/90174

虚拟机检测技术攻防

http://blog.csdn.net/whatday/article/details/10393325

x86_64 Reverse-Engineering

https://leotindall.com/tutorial/an-intro-to-x86_64-reverse-engineering/

Unpacking Shade Ransomware

https://secrary.com/ReversingMalware/UnpackingShade/

DDoS

https://www.secpulse.com/archives/64088.html
https://www.secpulse.com/archives/65477.html

Android So

https://bbs.pediy.com/thread-221965.htm

VMWare

https://remnux.org/docs/distro/tools/

MalwareCookBook

https://github.com/mgoffin/malwarecookbook

Malware Analyst Research Toolkit

https://github.com/mboman/mart

SSMA - Simple Static Malware Analyzer

https://github.com/secrary/SSMA

Malicious traffic detection system

https://github.com/stamparm/maltrail

Collection of android malware samples - Android Samples

https://github.com/ashishb/android-malware

Malware Source

https://github.com/Chiggins/malware_sources

List of awesome malware analysis tools and resources

https://github.com/wtsxDev/Malware-Analysis

A collection of OSX and iOS security resources

https://github.com/kai5263499/osx-security-awesome

Malware

https://github.com/0xBADBAC0N/malware

ARM Emulate

https://salmanarif.bitbucket.io/visual/downloads.html

Static and automated/dynamic malware analysis

https://github.com/abdesslem/malwareHunter

Rootkits | Backdoors | Sniffers | Virus | Ransomware | Steganography | Cryptography | Shellcodes | Webshells | Keylogger | Botnets | Worms | Other Network Tools

https://github.com/vduddu/Malware

Malware Classifier From Network Captures

https://github.com/adulau/MalwareClassifier

Collection of scripts for different malware analysis tasks

https://github.com/deadbits/malware-analysis-scripts

POC Android Malware Ransomware/Recon

https://github.com/tfairane/AndroMalware

Repository containing Yara rules, indicators and tools from PhishMe Research

https://github.com/phishme/malware_analysis

Binaries for the book Practical Malware Analysis

https://github.com/mikesiko/PracticalMalwareAnalysis-Labs

Android Malware

https://github.com/virqdroid/Android_Malware

Malware Behavior Analyzer

https://github.com/GlacierW/MBA

Debian packaging of Linux Malware Detect

https://github.com/waja/maldetect

Scanning and identifying XOR encrypted PE files in PE resources

https://github.com/edix/MalwareResourceScanner

Windows Malware Rootkit

https://github.com/csurage/Rootkit

Malware static analysis framework

https://github.com/KoreLogicSecurity/mastiff

Harmless Android malware using the overlay technique to steal user credentials.

https://github.com/geeksonsecurity/android-overlay-malware-example

My personal Automated Malware Analysis Sandboxes and Services

https://github.com/ironbits/Automated-Malware-Analysis-List

Collection of almost 40.000 javascript malware samples

https://github.com/HynekPetrak/javascript-malware-collection

Code for Deep Android Malware Detection paper

https://github.com/niallmcl/Deep-Android-Malware-Detection

Various scripts for different malware families

https://github.com/sysopfb/Malware_Scripts

iOS malware samples

https://github.com/ashishb/ios-malware

An Android Eclipse project demonstrating how to build a simple anti-malware application

https://github.com/twitter-university/AntiMalware

VMWare

https://app.vagrantup.com/boxes/search

Windows Resource Download

https://msdn.itellyou.cn/

Vulnhub

https://www.vulnhub.com/

Windbg XP

http://blog.csdn.net/jiangdf/article/details/6843088

360报告

http://blogs.360.cn/blog/category/%E7%97%85%E6%AF%92%E5%88%86%E6%9E%90/

Ransomware

https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-december-1st-2017-decryptors-btcware-and-more/
https://id-ransomware.malwarehunterteam.com/

IoT 门锁

https://larry.ngrep.me/2018/11/24/ble-sec-hackmelock/

VirtualKD

http://virtualkd.sysprogs.org/download/

OFFICE MALWARE/EXPLOIT

https://github.com/Screetsec/Microsploit
https://remnux.org/
https://r3mrum.wordpress.com/2017/06/29/analyzing-malicious-password-protected-office-documents/
https://dfir.it/blog/2015/06/17/analysts-handbook-analyzing-weaponized-documents/
https://zeltser.com/analyzing-malicious-documents/
https://www.shellntel.com/blog/2016/9/13/luckystrike-a-database-backed-evil-macro-generator
https://www.blackhillsinfosec.com/hide-payload-ms-office-document-properties/
https://securityoversimplicity.wordpress.com/2017/11/23/not-all-she-wrote-part-3-rigged-rtf-documents/
http://www.sdkhere.com/2017/12/analysis-of-file-spider-ransomware.html
https://pentestlab.blog/2017/12/15/microsoft-office-payloads-in-document-properties/
http://blog.51cto.com/antivirusjo/2054410　　 http://www.freebuf.com/vuls/159789.html
http://blog.safedog.cn/?p=1519
http://blog.safedog.cn/?p=2209
https://spreadsecurity.github.io/2016/08/14/macro-malware-analysis.html
http://sites.utexas.edu/iso/2016/07/08/reverse-engineering-a-malicious-ms-word-document/
http://www.freebuf.com/articles/terminal/74921.html
https://www.anquanke.com/post/id/84105

https://countuponsecurity.com/2014/09/22/malicious-documents-pdf-analysis-in-5-steps/　

https://countuponsecurity.com/2014/10/24/malicious-documents-word-with-vba-and-powershell/　　

https://www.cert-ist.com/public/en/SO_detail?code=malicious_pdf　　　　

http://netsecurity.51cto.com/art/200907/138668.htm　　　　

https://blog.didierstevens.com/category/pdf/　　　　

http://www.itbaby.me/blog/59f7ea965d21b31fcd4e2037　　　　

https://zeltser.com/media/docs/analyzing-malicious-document-files.pdf　　　

https://paper.seebug.org/351/　　　　

Linux x86 Exploit

https://bbs.pediy.com/user-507717-1.htm

Malware Samples

http://contagiodump.blogspot.com/
http://dasmalwerk.eu/
http://www.freetrojanbotnet.com/
https://malshare.com/
http://www.kernelmode.info/forum/viewforum.php?f=16
https://avcaesar.malware.lu/
http://www.malwareblacklist.com/showMDL.php
http://thezoo.morirt.com/
https://malwr.com/
http://openmalware.org/
http://www.virusign.com/
https://virusshare.com/

Free Automated Malware Analysis Sandboxes and Services

https://zeltser.com/automated-malware-analysis/

Free Online Tools for Looking up Potentially Malicious Websites

https://zeltser.com/lookup-malicious-websites/

APT Sample

https://contagiodump.blogspot.com/2017/02/russian-apt-apt28-collection-of-samples.html

CVE

CVE-2010-3333
http://blog.csdn.net/qq_32400847/article/details/70225519
https://wenku.baidu.com/view/11fd094384254b35effd3480.html
https://www.52pojie.cn/thread-290299-1-1.html
https://bbs.pediy.com/thread-158078.htm

CVE–2017–11882
http://bobao.360.cn/learning/detail/4734.html

CVE-2017-11826
https://blog.fortinet.com/2017/11/22/cve-2017-11826-exploited-in-the-wild-with-politically-themed-rtf-document

malware source

auto script

Course Book

https://github.com/RPISEC/Malware
https://github.com/rshipp/awesome-malware-analysis
https://github.com/mgoffin/malwarecookbook
https://github.com/MISP/MISP
https://github.com/wyyqyl/MalwareAnalysis
https://github.com/secmobi/amatutor
https://github.com/pandazheng/amatutor

AntiMalware Software

https://github.com/twitter-university/AntiMalware
https://github.com/ssesha/MalwareScanner
https://github.com/acprimer/MalwareDetector
https://github.com/kapilkchaurasia/Behavior-Based-Malware-Detection-System-for-Android

Samples

https://github.com/ashishb/ios-malware

APT

https://github.com/hfiref0x/CVE-2015-1701
https://github.com/michael-yip/APTMalwareNotes
https://github.com/abzcoding/aptdetector
https://github.com/harsh2602/APT-Detection-Via-Graph-Analytics
https://github.com/Tryan18/XCOM
https://github.com/aroradhruv03/APThreatDetectionSys
https://github.com/tobypinder/ludumdare32
https://github.com/hslatman/awesome-threat-intelligence
https://github.com/peterfelfer/AtomProbeTutorials

Tools

https://sourceforge.net/projects/remnux/files/
https://remnux.org/docs/distro/tools/

在线画图工具

https://www.processon.com/
http://www.xmindchina.net/

脱壳逆向

https://tuts4you.com
http://www.woodmann.com/
https://bbs.pediy.com/thread-224537.htm
https://bbs.pediy.com/thread-196797.htm

pandazheng / threat-intelligence-analyst Goto Github PK

threat-intelligence-analyst's Introduction

Threat-Intelligence-Analyst

TI威胁情报

Analyzing Malicious Password Protected Office Documents

Hack

恶意软件分析大合集

LifeOfBinarie

PNG Payload

Malware Sample Source

Malware Analyst

Malware分析文章

恶意样本分析

Resources for Learning Reverse Engineering

病毒分类

在线检测恶意软件网站

用命令行与Python使用YARA规则-识别恶意木马必备

ida视频

恶意样本分析

Malware Sample Sources for Researchers

List of Malware Sources

WMI BackDoor

IDA

malware analysis labs

Exploitation Archives

Exploits

VMP/TMD Unpack

MIPS 路由器木马

勒索软件信息

Linux Kernel Debug

PowerShell

Limon Sandbox For Analyzing Linux Malwares

Advanced Malware Analysis

WMI POWERSHELL 挖矿

CTF

CoinMiner

NET Malware

URL

Yara

教你构建自己的yara数据库

基础反调试技术总结

ARM Exploit

勒索软件分析报告

Docker分析文章

Android 加固分析

MalwareVbr

JS混淆

BitCode

Processon

RTFOBJ

Python

Linux Malware Analyst

Window Payload

PowerShell

PART 2A: INTRO TO THREAT HUNTING WITH KOLIDE FLEET, OSQUERY, POWERSHELL EMPIRE, AND CALDERA – SETUP ENVIRONMENT

R2

Proxmox & Cuckoo

威胁情报网站

恶意流量分析网站

安全网站

ML Malware

看雪知识库

NET逆向

虚拟机检测技术攻防

x86_64 Reverse-Engineering

Unpacking Shade Ransomware

DDoS

Android So

VMWare

MalwareCookBook

Malware Analyst Research Toolkit

SSMA - Simple Static Malware Analyzer

Malicious traffic detection system

Collection of android malware samples - Android Samples

Malware Source

List of awesome malware analysis tools and resources

A collection of OSX and iOS security resources

Malware

ARM Emulate

Static and automated/dynamic malware analysis