{
  "added_at": "2026-11-03",
  "additional_evidence_urls": [
    "https://github.com/CYB3RMX/Qu1cksc0pe/blob/180d44f44725bbce0296dc5346554fcf8852bbb2/setup.sh",
    "https://github.com/CYB3RMX/Qu1cksc0pe/blob/180d44f44725bbce0296dc5346554fcf8852bbb2/setup.ps1",
    "https://github.com/CYB3RMX/Qu1cksc0pe/blob/180d44f44725bbce0296dc5346554fcf8852bbb2/requirements.txt",
    "https://github.com/CYB3RMX/Qu1cksc0pe/blob/180d44f44725bbce0296dc5346554fcf8852bbb2/Dockerfile",
    "https://github.com/CYB3RMX/Qu1cksc0pe/blob/180d44f44725bbce0296dc5346554fcf8852bbb2/Systems/Multiple/multiple.conf",
    "https://github.com/CYB3RMX/Qu1cksc0pe/blob/180d44f44725bbce0296dc5346554fcf8852bbb2/Modules/hashScanner.py",
    "https://github.com/CYB3RMX/Qu1cksc0pe/blob/180d44f44725bbce0296dc5346554fcf8852bbb2/Modules/analysis/linux/linux_emulator.py",
    "https://github.com/CYB3RMX/Qu1cksc0pe/blob/180d44f44725bbce0296dc5346554fcf8852bbb2/Modules/mcp_server.py",
    "https://github.com/CYB3RMX/Qu1cksc0pe/blob/180d44f44725bbce0296dc5346554fcf8852bbb2/.mcp.json",
    "https://github.com/CYB3RMX/Qu1cksc0pe/tree/180d44f44725bbce0296dc5346554fcf8852bbb2/Systems/Windows",
    "https://github.com/CYB3RMX/Qu1cksc0pe/blob/180d44f44725bbce0296dc5346554fcf8852bbb2/LICENSE"
  ],
  "category": "native-analysis",
  "description_en": "All-in-one malware triage tool that statically analyses Windows PE, Linux ELF (including Go binaries), macOS Mach-O and Android APK, JAR and DEX files as well as Office and PDF documents, scripts, shortcuts, archives, e-mails and PCAPs, reporting imports and API categories, sections, strings and IOCs, packers, embedded executables, Android permission risk, YARA matches and, for Windows and Linux, MITRE ATT&CK mappings. VBA/VBScript, JavaScript and PowerShell are run through bounded in-memory emulators instead of being executed, and --watch modes monitor live Windows, Linux and Android processes. A CLI, a Flask web UI and an MCP server expose the analyses, with optional LLM summaries of the JSON reports.",
  "description_zh": "一体化恶意软件初筛工具，可对 Windows PE、Linux ELF（含 Go 二进制）、macOS Mach-O 和 Android APK、JAR、DEX 文件，以及 Office 与 PDF 文档、脚本、快捷方式、压缩包、电子邮件和 PCAP 做静态分析，报告导入表与 API 分类、节区、字符串与 IOC、加壳器、内嵌可执行文件、Android 权限风险和 YARA 匹配，并为 Windows 与 Linux 程序给出 MITRE ATT&CK 映射。VBA/VBScript、JavaScript 和 PowerShell 交由有界的内存内模拟器处理，而不会真正执行；--watch 模式可监视 Windows、Linux 和 Android 上运行中的进程。分析功能可通过命令行、Flask 网页界面和 MCP 服务器调用，还可选择用大语言模型总结 JSON 报告。",
  "entry_url": "https://awesomerea.org/resources/qu1cksc0pe/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/qu1cksc0pe/",
  "evidence_url": "https://github.com/CYB3RMX/Qu1cksc0pe/blob/180d44f44725bbce0296dc5346554fcf8852bbb2/README.md",
  "group": "tools",
  "id": "qu1cksc0pe",
  "json_url": "https://awesomerea.org/resources/qu1cksc0pe/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/qu1cksc0pe/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/qu1cksc0pe/index.md",
  "name": "Qu1cksc0pe",
  "name_zh": "Qu1cksc0pe 恶意软件分析工具",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "Actively developed from the master branch with no tags or GitHub releases; the reviewed commit of 2026-09-18 adds live-memory YARA/IOC scanning, Windows injection and hollowing checks and expanded Android dynamic analysis. README recommends Parrot OS, Kali Linux or Windows 10/11; Mach-O and Go binaries are analysed statically only.",
    "README has users clone the repository into a Python virtual environment and run setup.sh (apt-get or pacman hosts) or setup.ps1 on Windows. Setup installs requirements.txt, which pins androguard 3.4.0a1, yara-python 4.5.0 and unicorn 2.1.4 and adds lief, pefile, oletools, frida-tools, docker, flask and mcp>=2.0.0, plus adb, binutils strings, unzip, 7-Zip, JADX 1.5.3 in a sc0pe_Base folder in the home directory and Ollama with its configured model. A Dockerfile based on Ubuntu 22.04 runs the CLI against a mounted file. Hash scans download the HashDB SQLite database from the separate CYB3RMX/MalwareHashDB repository, and VirusTotal lookups need the user's own API key.",
    "Inputs are the analyst's own suspicious files. The repository ships detection data, about 300 YARA rule files, Android Frida scripts and API and ATT&CK mapping tables, plus a bundled dnlib 3.6.0 .NET library (Systems/Windows/dnlib.dll, from the open-source de4dot project) that the reviewed scripts do not reference by name; it contains no malware samples. Static analysis and the script emulators do not run samples, but Linux binary emulation runs them under qemu-user in a network-disabled Docker container, falling back to host qemu when Docker is unavailable, and the --watch modes attach to live processes on the host or a connected Android device. Handle samples only on an isolated analysis machine.",
    "--ai sends a report to Ollama by default; the shipped multiple.conf names the cloud-tagged kimi-k2.5:cloud model, for which setup.ps1 suggests ollama signin, and Claude, OpenAI, DeepSeek, Kimi and GLM backends are opt-in through --ai_provider, in which case report data leaves the machine. The MCP server (--mcp) exposes 14 tools over streamable HTTP on 127.0.0.1:8765 by default, or over stdio, and a bundled .mcp.json registers it for Claude Code. Family candidates, emulation traces and AI summaries are heuristic findings for analyst review.",
    "GPL-3.0."
  ],
  "requirements_zh": [
    "项目在 master 分支上持续开发，没有标签或 GitHub 发布版本；所审提交（2026-09-18）新增了实时内存 YARA/IOC 扫描、Windows 注入与镂空检测，并扩展了 Android 动态分析。README 推荐 Parrot OS、Kali Linux 或 Windows 10/11；Mach-O 和 Go 二进制仅支持静态分析。",
    "README 要求克隆仓库、在 Python 虚拟环境中运行 setup.sh（适用于 apt-get 或 pacman 系统），Windows 上则运行 setup.ps1。安装脚本会安装 requirements.txt，其中固定 androguard 3.4.0a1、yara-python 4.5.0 和 unicorn 2.1.4，并包含 lief、pefile、oletools、frida-tools、docker、flask 和 mcp>=2.0.0；另外还会安装 adb、binutils 的 strings、unzip、7-Zip、安装在用户主目录下 sc0pe_Base 文件夹中的 JADX 1.5.3，以及 Ollama 和配置中的模型。基于 Ubuntu 22.04 的 Dockerfile 可对挂载的文件运行命令行。哈希扫描会从独立的 CYB3RMX/MalwareHashDB 仓库下载 HashDB SQLite 数据库，VirusTotal 查询需要使用者自己的 API 密钥。",
    "输入是分析者自己的可疑文件。仓库附带检测数据，包括约 300 个 YARA 规则文件、Android Frida 脚本以及 API 与 ATT&CK 映射表，另附一份 dnlib 3.6.0 .NET 库（Systems/Windows/dnlib.dll，来自开源的 de4dot 项目），所审脚本均未按名称引用它；仓库不含恶意软件样本。静态分析和脚本模拟器不会运行样本，但 Linux 二进制模拟会在禁用网络的 Docker 容器中用 qemu-user 运行样本，没有 Docker 时退回到宿主机上的 qemu；--watch 模式则附加到宿主机或所连 Android 设备上的运行中进程。只应在隔离的分析机器上处理样本。",
    "--ai 默认把报告交给 Ollama；随附的 multiple.conf 指定带 cloud 标记的 kimi-k2.5:cloud 模型，setup.ps1 为此建议执行 ollama signin；Claude、OpenAI、DeepSeek、Kimi 和 GLM 后端需通过 --ai_provider 主动选择，此时报告数据会离开本机。MCP 服务器（--mcp）默认通过 127.0.0.1:8765 上的 streamable HTTP 提供 14 个工具，也可用 stdio；随附的 .mcp.json 会为 Claude Code 注册该服务器。家族候选、模拟轨迹和 AI 总结都属于启发式结果，需要分析者复核。",
    "GPL-3.0 许可。"
  ],
  "targets": [
    "app",
    "binary"
  ],
  "url": "https://github.com/CYB3RMX/Qu1cksc0pe",
  "verification": "source-reviewed",
  "verified_at": "2026-10-27"
}