AwesomeREA.org

Tool

Qu1cksc0pe

All-in-one malware triage tool that statically analyses Windows PE, Linux ELF (including Go binaries), macOS Mach-O and Android APK, JAR and DEX files as well as Office and PDF documents, scripts, shortcuts, archives, e-mails and PCAPs, reporting imports and API categories, sections, strings and IOCs, packers, embedded executables, Android permission risk, YARA matches and, for Windows and Linux, MITRE ATT&CK mappings. VBA/VBScript, JavaScript and PowerShell are run through bounded in-memory emulators instead of being executed, and --watch modes monitor live Windows, Linux and Android processes. A CLI, a Flask web UI and an MCP server expose the analyses, with optional LLM summaries of the JSON reports.

Targets
App · Binary
Category
Native analysis tools
Relationship
Foundation tool
Sources reviewed

Requirements & limits

  • Actively developed from the master branch with no tags or GitHub releases; the reviewed commit of 2026-09-18 adds live-memory YARA/IOC scanning, Windows injection and hollowing checks and expanded Android dynamic analysis. README recommends Parrot OS, Kali Linux or Windows 10/11; Mach-O and Go binaries are analysed statically only.
  • README has users clone the repository into a Python virtual environment and run setup.sh (apt-get or pacman hosts) or setup.ps1 on Windows. Setup installs requirements.txt, which pins androguard 3.4.0a1, yara-python 4.5.0 and unicorn 2.1.4 and adds lief, pefile, oletools, frida-tools, docker, flask and mcp>=2.0.0, plus adb, binutils strings, unzip, 7-Zip, JADX 1.5.3 in a sc0pe_Base folder in the home directory and Ollama with its configured model. A Dockerfile based on Ubuntu 22.04 runs the CLI against a mounted file. Hash scans download the HashDB SQLite database from the separate CYB3RMX/MalwareHashDB repository, and VirusTotal lookups need the user's own API key.
  • Inputs are the analyst's own suspicious files. The repository ships detection data, about 300 YARA rule files, Android Frida scripts and API and ATT&CK mapping tables, plus a bundled dnlib 3.6.0 .NET library (Systems/Windows/dnlib.dll, from the open-source de4dot project) that the reviewed scripts do not reference by name; it contains no malware samples. Static analysis and the script emulators do not run samples, but Linux binary emulation runs them under qemu-user in a network-disabled Docker container, falling back to host qemu when Docker is unavailable, and the --watch modes attach to live processes on the host or a connected Android device. Handle samples only on an isolated analysis machine.
  • --ai sends a report to Ollama by default; the shipped multiple.conf names the cloud-tagged kimi-k2.5:cloud model, for which setup.ps1 suggests ollama signin, and Claude, OpenAI, DeepSeek, Kimi and GLM backends are opt-in through --ai_provider, in which case report data leaves the machine. The MCP server (--mcp) exposes 14 tools over streamable HTTP on 127.0.0.1:8765 by default, or over stdio, and a bundled .mcp.json registers it for Claude Code. Family candidates, emulation traces and AI summaries are heuristic findings for analyst review.
  • GPL-3.0. Nothing was installed or run and no samples were analysed in this review; the reviewed sources establish no REA connection.

About this entry

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · CYB3RMX/Qu1cksc0pe · Revision 180d44f
  2. setup.sh GitHub · CYB3RMX/Qu1cksc0pe · Revision 180d44f
  3. setup.ps1 GitHub · CYB3RMX/Qu1cksc0pe · Revision 180d44f
  4. requirements.txt GitHub · CYB3RMX/Qu1cksc0pe · Revision 180d44f
  5. Dockerfile GitHub · CYB3RMX/Qu1cksc0pe · Revision 180d44f
  6. Systems/Multiple/multiple.conf GitHub · CYB3RMX/Qu1cksc0pe · Revision 180d44f
  7. Modules/hashScanner.py GitHub · CYB3RMX/Qu1cksc0pe · Revision 180d44f
  8. Modules/analysis/linux/linux_emulator.py GitHub · CYB3RMX/Qu1cksc0pe · Revision 180d44f
  9. Modules/mcp_server.py GitHub · CYB3RMX/Qu1cksc0pe · Revision 180d44f
  10. .mcp.json GitHub · CYB3RMX/Qu1cksc0pe · Revision 180d44f
  11. Systems/Windows GitHub · CYB3RMX/Qu1cksc0pe · Revision 180d44f
  12. LICENSE GitHub · CYB3RMX/Qu1cksc0pe · Revision 180d44f

More in Native binaries

All 158 entries in Native binaries