alexandreborges/malwoverview

Malwoverview is a first response tool for threat hunting across VirusTotal, Hybrid Analysis, URLHaus, Polyswarm, Malshare, Alien Vault, Malpedia, Malware Bazaar, ThreatFox, Triage, IPInfo, Shodan, AbuseIPDB, GreyNoise, URLScan.io, Whois/RDAP, NIST, and VulnCheck. Supports LLM enrichment, IOC extraction, YARA scanning, and Android analysis.

What it solves

Malwoverview is a first-response tool for threat hunting and malware triage. It streamlines the process of gathering intelligence on suspect files, URLs, IP addresses, and domains by acting as a unified client for dozens of existing sandboxes and threat intelligence services.

How it works

The tool integrates with numerous external APIs (such as VirusTotal, Hybrid Analysis, and Shodan) to retrieve static and dynamic behavior reports, check reputations, and download samples. It also provides local triage capabilities, such as PE file analysis, Authenticode signature checking, and YARA scanning, which do not require API keys. For advanced analysis, it includes an optional LLM-powered enrichment layer that uses AI to generate risk assessments and map results to the MITRE ATT&CK framework.

Who it’s for

Security analysts, threat hunters, and malware researchers who need to quickly triage suspect indicators of compromise (IOCs) and correlate data across multiple intelligence sources.

Highlights

  • Multi-Service Integration: Unified access to over 15 threat intelligence services including VirusTotal, Malware Bazaar, and AlienVault.
  • LLM-Powered Enrichment: Optional AI-generated risk assessments and analyst recommendations using Claude, Gemini, OpenAI, or local Ollama models.
  • Local Triage: Built-in PE triage, entropy calculation, and Authenticode signature verification without needing external APIs.
  • Comprehensive Tooling: Supports YARA rule scanning, batch hash checks, and a TUI (Text User Interface) dashboard for navigation.
  • Privacy-Focused: Does not submit samples to endpoints by default to respect NDAs.

Related

  • Project
    Pantheon-Security/medusa

    An AI-first security scanner with 40,000+ detection patterns to identify vulnerabilities in AI/ML apps, agents, and leaked secrets in AI chat histories.

  • Project
    facebook/ThreatExchange

    A collection of tools and APIs for content moderation and security threat intelligence, featuring image and video hashing algorithms for similarity matching.

  • Project
    thalesgroup-cert/Watcher

    An AI-powered cybersecurity threat detection platform that automates the discovery and monitoring of emerging threats, data leaks, and malicious domains.

  • Project
    mandiant/stringsifter

    A machine learning tool that automatically ranks strings extracted from binaries to help malware analysts quickly identify the most relevant information.

  • Project
    promptfoo/promptfoo

    A CLI and library for evaluating and red-teaming LLM applications to replace trial-and-error prompt engineering with data-driven testing and security scanning.