f0wl

Malware Analysis and Reverse Engineering

SECUINFRA Falcon Team

Pinned Repositories

blackCatConf
Configuration Extractor for BlackCat Ransomware
Language:Go30 1 04
configmatter-linux
Static configuration extractor for the ESXI/Linux variant of BlackMatter Ransomware
Language:Go0 1 01
configmatter-windows
Configuration Extractor for the Windows variant of BlackMatter Ransomware
Language:Go1 1 01
configwalker
Netwalker Ransomware Config Extractor
Language:Go9 2 05
danaConfig
Static configuration extractor for DanaBot (main component)
Language:Go5 1 00
ezuri_unpack
Simple unpacking script for Ezuri ELF Crypter
Language:Go26 2 04
MalwareLab_VM-Setup
Setup scripts for my Malware Analysis VMs
Language:PowerShell239 10 648
REconfig-linux
Configuration Extractor for the Linux variant of REvil Ransomware
Language:Go7 1 01
yara_rules
A collection of yara rules that I created during analysis / for blog posts
Language:YARA8 1 03
zipExec_unpack
Unpacking tool for the zipExec Crypter
Language:Go13 2 05

f0wl's Repositories

f0wl/MalwareLab_VM-Setup
Setup scripts for my Malware Analysis VMs
Language:PowerShell239 10 648
f0wl/blackCatConf
Configuration Extractor for BlackCat Ransomware
Language:Go30 1 04
f0wl/ezuri_unpack
Simple unpacking script for Ezuri ELF Crypter
Language:Go26 2 04
f0wl/zipExec_unpack
Unpacking tool for the zipExec Crypter
Language:Go13 2 05
f0wl/configwalker
Netwalker Ransomware Config Extractor
Language:Go9 2 05
f0wl/yara_rules
A collection of yara rules that I created during analysis / for blog posts
Language:YARA8 1 03
f0wl/REconfig-linux
Configuration Extractor for the Linux variant of REvil Ransomware
Language:Go7 1 01
f0wl/danaConfig
Static configuration extractor for DanaBot (main component)
Language:Go5 1 00
f0wl/configzone
Configuration Extractor for Warzone RAT
Language:Go4 1 01
f0wl/deICEr
A crude Config Extractor for IcedID second stage Loaders (Zero2Auto Week 0x02)
Language:Go3 2 01
f0wl/inMediasREs
A static analysis tool built with Go and TermUI
Language:Go3 0 52
f0wl/avaddon-strings
String Decrypter for Avaddon Ransomware
Language:Go2 1 0
f0wl/hanconfig
Static configuration extractor for Hancitor Loader
Language:Go2 1 0
f0wl/CitrixHoneypot
Detect and log CVE-2019-19781 scan and exploitation attempts.
Language:HTML1 0 0
f0wl/configmatter-windows
Configuration Extractor for the Windows variant of BlackMatter Ransomware
Language:Go1 1 01
f0wl/Daily-dose-of-malware
Script lets you gather malicious software and c&c servers from open source platforms like Malshare, Malcode, Google, Cymon - vxvault, cybercrime tracker and c2 for Pony.
Language:Python1 0 0
f0wl/de4dot
.NET deobfuscator and unpacker.
Language:C#1 0 0
f0wl/Detection
Language:YARA1 0 0
f0wl/f0wl
Special Repository for Account Readme
1 2 0
f0wl/fakematter
Command&Control emulator for BlackMatter ransomware (ESXi/Linux)
Language:Go1 2 0
f0wl/huan_unpack
Unpacking script for the Huan PE Crypter
Language:Go1 1 0
f0wl/MalwareSourceCode
Collection of malware source code for a variety of platforms in an array of different programming languages.
Language:Assembly1 0 0
f0wl/viper
Binary analysis and management framework
Language:Python1 0 0
f0wl/configmatter-linux
Static configuration extractor for the ESXI/Linux variant of BlackMatter Ransomware
Language:Go0 1 01
f0wl/bootguard-status
A list of mainboards with BootGuard status
1 0
f0wl/GootJasperDeobfuscator
A deobfuscation script for Gootkit / Jasper Loader Malware
Language:Python1 0
f0wl/gotools
Plugin for Ghidra to assist reversing Golang binaries
Language:Java0 01
f0wl/REHelper
REHelper is an utility for initial binary analysis.
Language:Python0 0
f0wl/RemillWorkshop
Language:C++0 0
f0wl/Unprotect_Submission
Repository to publish your evasion techniques and contribute to the project