# Qu1cksc0pe

> All-in-one malware triage tool that statically analyses Windows PE, Linux ELF (including Go binaries), macOS Mach-O and Android APK, JAR and DEX files as well as Office and PDF documents, scripts, shortcuts, archives, e-mails and PCAPs, reporting imports and API categories, sections, strings and IOCs, packers, embedded executables, Android permission risk, YARA matches and, for Windows and Linux, MITRE ATT&CK mappings. VBA/VBScript, JavaScript and PowerShell are run through bounded in-memory emulators instead of being executed, and --watch modes monitor live Windows, Linux and Android processes. A CLI, a Flask web UI and an MCP server expose the analyses, with optional LLM summaries of the JSON reports.

- Type: Tool
- Targets: App · Binary
- Category: Native analysis tools
- Relationship: Foundation tool
- Sources reviewed: 2026-10-27
- Added to the catalog: 2026-11-03
- Original resource: <https://github.com/CYB3RMX/Qu1cksc0pe>
- Primary source: <https://github.com/CYB3RMX/Qu1cksc0pe/blob/180d44f44725bbce0296dc5346554fcf8852bbb2/README.md>
- Catalog page: <https://awesomerea.org/resources/qu1cksc0pe/>
- Record JSON: <https://awesomerea.org/resources/qu1cksc0pe/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/qu1cksc0pe/index.md)

## Requirements & limits

- Actively developed from the master branch with no tags or GitHub releases; the reviewed commit of 2026-09-18 adds live-memory YARA/IOC scanning, Windows injection and hollowing checks and expanded Android dynamic analysis. README recommends Parrot OS, Kali Linux or Windows 10/11; Mach-O and Go binaries are analysed statically only.
- README has users clone the repository into a Python virtual environment and run setup.sh (apt-get or pacman hosts) or setup.ps1 on Windows. Setup installs requirements.txt, which pins androguard 3.4.0a1, yara-python 4.5.0 and unicorn 2.1.4 and adds lief, pefile, oletools, frida-tools, docker, flask and mcp>=2.0.0, plus adb, binutils strings, unzip, 7-Zip, JADX 1.5.3 in a sc0pe_Base folder in the home directory and Ollama with its configured model. A Dockerfile based on Ubuntu 22.04 runs the CLI against a mounted file. Hash scans download the HashDB SQLite database from the separate CYB3RMX/MalwareHashDB repository, and VirusTotal lookups need the user's own API key.
- Inputs are the analyst's own suspicious files. The repository ships detection data, about 300 YARA rule files, Android Frida scripts and API and ATT&CK mapping tables, plus a bundled dnlib 3.6.0 .NET library (Systems/Windows/dnlib.dll, from the open-source de4dot project) that the reviewed scripts do not reference by name; it contains no malware samples. Static analysis and the script emulators do not run samples, but Linux binary emulation runs them under qemu-user in a network-disabled Docker container, falling back to host qemu when Docker is unavailable, and the --watch modes attach to live processes on the host or a connected Android device. Handle samples only on an isolated analysis machine.
- --ai sends a report to Ollama by default; the shipped multiple.conf names the cloud-tagged kimi-k2.5:cloud model, for which setup.ps1 suggests ollama signin, and Claude, OpenAI, DeepSeek, Kimi and GLM backends are opt-in through --ai_provider, in which case report data leaves the machine. The MCP server (--mcp) exposes 14 tools over streamable HTTP on 127.0.0.1:8765 by default, or over stdio, and a bundled .mcp.json registers it for Claude Code. Family candidates, emulation traces and AI summaries are heuristic findings for analyst review.
- GPL-3.0.

## Primary sources

1. <https://github.com/CYB3RMX/Qu1cksc0pe/blob/180d44f44725bbce0296dc5346554fcf8852bbb2/README.md>
2. <https://github.com/CYB3RMX/Qu1cksc0pe/blob/180d44f44725bbce0296dc5346554fcf8852bbb2/setup.sh>
3. <https://github.com/CYB3RMX/Qu1cksc0pe/blob/180d44f44725bbce0296dc5346554fcf8852bbb2/setup.ps1>
4. <https://github.com/CYB3RMX/Qu1cksc0pe/blob/180d44f44725bbce0296dc5346554fcf8852bbb2/requirements.txt>
5. <https://github.com/CYB3RMX/Qu1cksc0pe/blob/180d44f44725bbce0296dc5346554fcf8852bbb2/Dockerfile>
6. <https://github.com/CYB3RMX/Qu1cksc0pe/blob/180d44f44725bbce0296dc5346554fcf8852bbb2/Systems/Multiple/multiple.conf>
7. <https://github.com/CYB3RMX/Qu1cksc0pe/blob/180d44f44725bbce0296dc5346554fcf8852bbb2/Modules/hashScanner.py>
8. <https://github.com/CYB3RMX/Qu1cksc0pe/blob/180d44f44725bbce0296dc5346554fcf8852bbb2/Modules/analysis/linux/linux_emulator.py>
9. <https://github.com/CYB3RMX/Qu1cksc0pe/blob/180d44f44725bbce0296dc5346554fcf8852bbb2/Modules/mcp_server.py>
10. <https://github.com/CYB3RMX/Qu1cksc0pe/blob/180d44f44725bbce0296dc5346554fcf8852bbb2/.mcp.json>
11. <https://github.com/CYB3RMX/Qu1cksc0pe/tree/180d44f44725bbce0296dc5346554fcf8852bbb2/Systems/Windows>
12. <https://github.com/CYB3RMX/Qu1cksc0pe/blob/180d44f44725bbce0296dc5346554fcf8852bbb2/LICENSE>

## More in Native binaries

- [AppMon](https://awesomerea.org/resources/appmon/index.md) · Tool
- [Yagi](https://awesomerea.org/resources/yagi-ghidra-decompiler-for-ida/index.md) · Tool
- [frida-scripts (0xdea)](https://awesomerea.org/resources/raptor-frida-scripts/index.md) · Tool
- [System Informer](https://awesomerea.org/resources/system-informer/index.md) · Tool
- [CyberChef](https://awesomerea.org/resources/cyberchef/index.md) · Tool
- [YARA](https://awesomerea.org/resources/yara/index.md) · Tool

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.