Topics / #malware-analysis

Malware-analysis projects on GitHub

Reverse engineering and analyzing malicious software

As of , the most-starred Malware-analysis projects on GitHub are Awesome-Hacking (122.9K stars), ghidra (89.8K stars) and x64dbg (49.9K stars). GitHub.Locker tracks 34 Malware-analysis repositories with 640.9K stars combined. The fastest-growing on October 16 was ghidra, with +757 stars in a day.

34Projects
640.9KStars in total
+1.5KStars in a day
Browse in the catalog →github.com/topics/malware-analysis ↗

Hot right now

Most stars gained in a day · Oct 16

+757

ghidra

NationalSecurityAgency/ghidra · ★ 89.8K

Ghidra is a software reverse engineering (SRE) framework created and maintained by the NSA's Research Directorate, used to disassemble, decompile, graph, and analyze compiled code.

+165

reverse-skill

zhaoxuya520/reverse-skill · ★ 42.4K

It is a skill pack that routes AI coding agents to the right reverse engineering, penetration testing, and security research methodology for a given task (APK, binary, JS, CTF, malware, etc.), checks which tools are installed, and runs a repeatable workflow instead of letting the agent guess commands.

+104

Awesome-Hacking

Hack-with-Github/Awesome-Hacking · ★ 122.9K

A massive index that links out to dozens of other awesome-lists covering nearly every security domain: android security, bug bounty, fuzzing, malware analysis, OSINT, reverse engineering, web hacking, and more.

+96

Seep-Reverse-Lab

angusdevgo/Seep-Reverse-Lab · ★ 1.7K

Seep Reverse Lab is an agent-native reverse engineering and security-audit workbench that lets an AI coding agent autonomously run Radare2, JADX, Apktool and Frida to triage binaries, decompile APKs, and determine whether an app's feature gates are enforced locally or verified by a server (a CWE-602 authorization audit).

The all-time top

34 projects · by stars

  1. #1 · Hack-with-Github/Awesome-Hacking

    Awesome-Hacking

    A massive index that links out to dozens of other awesome-lists covering nearly every security domain: android security, bug bounty, fuzzing, malware analysis, OSINT, reverse engineering, web hacking, and more.

    122.9K
  2. #2 · NationalSecurityAgency/ghidra

    ghidra

    Ghidra is a software reverse engineering (SRE) framework created and maintained by the NSA's Research Directorate, used to disassemble, decompile, graph, and analyze compiled code.

    89.8K
  3. #3 · x64dbg/x64dbg

    x64dbg

    x64dbg is an open-source user-mode debugger for Windows, built specifically for reverse engineering and malware analysis.

    49.9K
  1. 4

    reverse-skill

    42.4Kzhaoxuya520/reverse-skill · PowerShell

    It is a skill pack that routes AI coding agents to the right reverse engineering, penetration testing, and security research methodology for a given task (APK, binary, JS, CTF, malware, etc.), checks which tools are installed, and runs a repeatable workflow instead of letting the agent guess commands.

  2. 5

    Anthropic-Cybersecurity-Skills

    34.6Kmukul975/Anthropic-Cybersecurity-Skills · Python

    An open-source library of 818 production-grade cybersecurity skills for AI agents, covering 34 security domains and mapped to six frameworks including MITRE ATT&CK and NIST CSF 2.0.

  3. 6

    awesome-osint

    30.3Kjivoi/awesome-osint

    This is a curated 'awesome list' of hundreds of free and paid OSINT (open source intelligence) tools and resources, organized into categories like general search, Google dorks, data breach lookup, social media, threat actors, and dark web.

  4. 7

    dnSpy

    29.7KdnSpy/dnSpy · C#

    dnSpy is a Windows debugger and assembly editor for .NET and Unity programs - it lets you set breakpoints, step through code, and even edit methods and metadata without having the original source code.

  5. 8

    radare2

    25.1Kradareorg/radare2 · C

    r2 (radare2) is a libre reverse engineering framework for Unix-like systems: a set of libraries, tools and plugins for analyzing, disassembling, emulating, debugging and modifying binaries.

  6. 9

    Mobile-Security-Framework-MobSF

    22KMobSF/Mobile-Security-Framework-MobSF · JavaScript

    MobSF is an automated, all-in-one mobile security framework: it performs static and dynamic analysis, penetration testing, malware analysis and privacy analysis on Android, iOS and Windows Mobile apps.

  7. 10

    Awesome-Hacking-Resources

    17.5Kvitalysim/Awesome-Hacking-Resources

    A curated collection of hacking, penetration testing and AI red-teaming resources — courses, YouTube channels, CTF platforms and guides, picked to make you better at offensive security.

  8. 11

    hacker-roadmap

    15.7Ksundowndev/hacker-roadmap

    This is a curated roadmap and toolkit index for learning and practicing ethical hacking: it explains what penetration testing is and groups hundreds of security tools, wordlists and references by category (recon, password attacks, wireless, exploitation, web hacking, post-exploitation, frameworks).

  9. 12

    mvt

    15.4Kmvt-project/mvt · Python

    MVT (Mobile Verification Toolkit) is a collection of forensic utilities that help gather and analyze traces on Android and iOS devices to identify a potential compromise, originally built by Amnesty International's Security Lab during the Pegasus Project.

  10. 13

    awesome-security

    15Ksbilly/awesome-security

    A curated, categorized collection of well-known security resources — software, libraries, documents, books and other cool stuff — maintained by the community in the spirit of awesome-php and awesome-python.

  11. 14

    awesome-malware-analysis

    14.3Krshipp/awesome-malware-analysis

    A curated 'awesome list' of malware analysis tools and resources, covering sample collection, sandboxes, detection tools, threat intelligence feeds, reverse engineering, and forensics.

  12. 15

    PENTESTING-BIBLE

    14KblaCCkHatHacEEkr/PENTESTING-BIBLE

    A curated catalog of over 200 numbered links to pentesting articles, bug bounty write-ups, cheat sheets and other security lists — a reading collection, not software.

  13. 16

    theZoo

    13.5Kytisf/theZoo · Python

    theZoo is a public repository of live malware samples and their source code, gathered so that anyone interested in malware analysis can study real specimens in an organized and accessible way.

  14. 17

    ida-pro-mcp

    13Kmrexodia/ida-pro-mcp · Python

    It is an MCP server that bridges IDA Pro with AI language models, letting coding agents like Claude, Codex or Cursor help you reverse engineer binaries ('vibe reversing').

  15. 18

    Detect-It-Easy

    11.7Khorsicq/Detect-It-Easy · JavaScript

    Detect It Easy (DiE) is a cross-platform tool that identifies file types and inspects executables (PE, ELF, Mach-O) for malware analysts, reverse engineers, and cybersecurity researchers, combining signature-based detection with a deep heuristic engine.

  16. 19

    GhidraMCP

    11.4KLaurieWired/GhidraMCP · Java

    GhidraMCP is a Model Context Protocol server that lets LLMs autonomously reverse engineer applications by exposing Ghidra's core functionality (decompiling, renaming, listing imports/exports) to any MCP client.

  17. 20

    pwndbg

    11.1Kpwndbg/pwndbg · Python

    A plug-in for GDB and LLDB that makes debugging far less painful for low-level developers, hardware hackers, reverse-engineers and exploit developers — it adds the utilities vanilla debuggers are missing.

  18. 21

    reverse-engineering

    10.6KwtsxDev/reverse-engineering

    A curated list of reverse engineering resources: books, courses, practice grounds, and a big toolbox section spanning hex editors, disassemblers, debuggers, and dynamic analysis tools.

  19. 22

    awesome-honeypots

    10.6Kparalax/awesome-honeypots · Python

    A curated, categorized list of honeypot software and related tools used by security researchers to deceive attackers, log their behavior, and study exploitation attempts.

  20. 23

    skills

    7.6Ktrailofbits/skills · Python

    This is Trail of Bits' Claude Code plugin marketplace: a curated collection of AI-agent skills for security research, vulnerability detection, and audit workflows, covering everything from smart contract audits to malware analysis and reverse engineering.

  21. 24

    raptor

    3.9Kgadievron/raptor · Python

    RAPTOR turns a Claude Code session into an offensive/defensive security agent: Claude.md rules, sub-agents and skills orchestrate tools like radare2, Frida, Z3 and CodeQL for binary reverse-engineering, exploit-feasibility research, and software supply-chain (SCA) analysis.

  22. 25

    x64dbg-mcp-server

    2.5Kduty1g/x64dbg-mcp-server · Zig

    x64dbg-MCP Server is a native plugin for the x64dbg debugger that exposes its full functionality over HTTP via the Model Context Protocol (MCP), letting any MCP-compatible AI assistant programmatically set breakpoints, step through code, read memory, dump registers, and more.

  23. 26

    Seep-Reverse-Lab

    1.7Kangusdevgo/Seep-Reverse-Lab · Lua

    Seep Reverse Lab is an agent-native reverse engineering and security-audit workbench that lets an AI coding agent autonomously run Radare2, JADX, Apktool and Frida to triage binaries, decompile APKs, and determine whether an app's feature gates are enforced locally or verified by a server (a CWE-602 authorization audit).

  24. 27

    reverify

    1.3K2akouwu/reverify · Python

    Reverify is a tool that stops AI agents from hallucinating facts by making a deterministic toolkit verify every claim the model makes against ground truth, with reverse engineering as the main proving ground.

  25. 28

    dsh-redteam-model

    719SeaOf0/dsh-redteam-model · Python

    A plugin pack for the dsh (DeepSeek Harness) AI agent that adds nine preset red-team security research modes and seventeen runtime plugins, covering pentesting, code audit, binary analysis, anti-detection, incident response, cloud security and CTF solving.

  26. 29

    Offensive-Security-AI-Models

    691JoasASantos/Offensive-Security-AI-Models

    A curated list of open-weight, uncensored language models fine-tuned for offensive-security tasks like penetration testing, red teaming, and security research. The README documents over 20 models sourced from HuggingFace model cards as of September 2026.

  27. 30

    awesome-reverse-engineering

    691morluto/awesome-reverse-engineering

    A curated list of reverse-engineering tools and learning resources covering binaries, applications, firmware, file formats, and protocols, organized by the task you need to do rather than alphabetically.

  28. 31

    Stuxnet

    588Sadpainy/Stuxnet · C

    This is a reconstructed source code of Stuxnet, the famous 2010 worm that sabotaged Siemens industrial control systems, rebuilt by the author from reverse-engineering research for educational and malware-analysis purposes.

  29. 32

    vmp-lazy-unpack

    402x86rc/vmp-lazy-unpack · Python

    This is a Python tool that automatically unpacks Windows x64 binaries protected with VMProtect 3.x and rebuilds their import table (IAT), without needing a debugger or live memory dump.

  30. 33

    ablation

    214Ablation-Tool/ablation · Python

    Ablation is a reverse engineering framework that provides the same core disassembly, decompilation, and binary analysis capabilities as industry tools like Ghidra, IDA Pro, and Binary Ninja, and it's built to be driven by an AI coding agent.

  31. 34

    vol-rs

    197daffainfo/vol-rs · Rust

    'vol-rs' is a line-by-line port of the Volatility 3 memory forensics framework from Python to Rust. It reads the same memory images, runs the same plugins with the same options, and prints byte-for-byte identical output, just much faster.

Often tagged together