Awesome REA
中文Star on GitHubStar1.1k stars
Star on GitHubStar1.1k stars

Tool

Qu1cksc0pe

All-in-one malware triage tool that statically analyses Windows PE, Linux ELF (including Go binaries), macOS Mach-O and Android APK, JAR and DEX files as well as Office and PDF documents, scripts, shortcuts, archives, e-mails and PCAPs, reporting imports and API categories, sections, strings and IOCs, packers, embedded executables, Android permission risk, YARA matches and, for Windows and Linux, MITRE ATT&CK mappings. VBA/VBScript, JavaScript and PowerShell are run through bounded in-memory emulators instead of being executed, and --watch modes monitor live Windows, Linux and Android processes. A CLI, a Flask web UI and an MCP server expose the analyses, with optional LLM summaries of the JSON reports.

Targets
App · Binary
Category
Native analysis tools
Relationship
Foundation tool
Sources reviewed

Requirements & limits

  • Actively developed from the master branch with no tags or GitHub releases; the reviewed commit of 2026-09-18 adds live-memory YARA/IOC scanning, Windows injection and hollowing checks and expanded Android dynamic analysis. README recommends Parrot OS, Kali Linux or Windows 10/11; Mach-O and Go binaries are analysed statically only.
  • README has users clone the repository into a Python virtual environment and run setup.sh (apt-get or pacman hosts) or setup.ps1 on Windows. Setup installs requirements.txt, which pins androguard 3.4.0a1, yara-python 4.5.0 and unicorn 2.1.4 and adds lief, pefile, oletools, frida-tools, docker, flask and mcp>=2.0.0, plus adb, binutils strings, unzip, 7-Zip, JADX 1.5.3 in a sc0pe_Base folder in the home directory and Ollama with its configured model. A Dockerfile based on Ubuntu 22.04 runs the CLI against a mounted file. Hash scans download the HashDB SQLite database from the separate CYB3RMX/MalwareHashDB repository, and VirusTotal lookups need the user's own API key.
  • Inputs are the analyst's own suspicious files. The repository ships detection data, about 300 YARA rule files, Android Frida scripts and API and ATT&CK mapping tables, plus a bundled dnlib 3.6.0 .NET library (Systems/Windows/dnlib.dll, from the open-source de4dot project) that the reviewed scripts do not reference by name; it contains no malware samples. Static analysis and the script emulators do not run samples, but Linux binary emulation runs them under qemu-user in a network-disabled Docker container, falling back to host qemu when Docker is unavailable, and the --watch modes attach to live processes on the host or a connected Android device. Handle samples only on an isolated analysis machine.
  • --ai sends a report to Ollama by default; the shipped multiple.conf names the cloud-tagged kimi-k2.5:cloud model, for which setup.ps1 suggests ollama signin, and Claude, OpenAI, DeepSeek, Kimi and GLM backends are opt-in through --ai_provider, in which case report data leaves the machine. The MCP server (--mcp) exposes 14 tools over streamable HTTP on 127.0.0.1:8765 by default, or over stdio, and a bundled .mcp.json registers it for Claude Code. Family candidates, emulation traces and AI summaries are heuristic findings for analyst review.
  • GPL-3.0.

About this entry

The description was reviewed against primary sources.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · CYB3RMX/Qu1cksc0pe · Revision 180d44f
  2. setup.sh GitHub · CYB3RMX/Qu1cksc0pe · Revision 180d44f
  3. setup.ps1 GitHub · CYB3RMX/Qu1cksc0pe · Revision 180d44f
  4. requirements.txt GitHub · CYB3RMX/Qu1cksc0pe · Revision 180d44f
  5. Dockerfile GitHub · CYB3RMX/Qu1cksc0pe · Revision 180d44f
  6. Systems/Multiple/multiple.conf GitHub · CYB3RMX/Qu1cksc0pe · Revision 180d44f
  7. Modules/hashScanner.py GitHub · CYB3RMX/Qu1cksc0pe · Revision 180d44f
  8. Modules/analysis/linux/linux_emulator.py GitHub · CYB3RMX/Qu1cksc0pe · Revision 180d44f
  9. Modules/mcp_server.py GitHub · CYB3RMX/Qu1cksc0pe · Revision 180d44f
  10. .mcp.json GitHub · CYB3RMX/Qu1cksc0pe · Revision 180d44f
  11. Systems/Windows GitHub · CYB3RMX/Qu1cksc0pe · Revision 180d44f
  12. LICENSE GitHub · CYB3RMX/Qu1cksc0pe · Revision 180d44f

More in Native binaries

All 269 entries in Native binaries

↑↓ move↵ open⌘↵ new tab