Skip to content
View malwarelens's full-sized avatar
19 followers · 165 following
  • Los Angeles, CA

Highlights

  • Pro

Block or report malwarelens

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Content in all repositories owned by your account will be closed.
Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. Markdown is supported. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
malwarelens/README.md

Hi, I'm malwarelens

Malware Reverse Engineer · Windows Internals · Endpoint Security

Founder of a security research company, with 10+ years of experience in reverse engineering. My day-to-day work is defensive malware analysis: dissecting samples in an isolated lab to understand their behavior, extract indicators of compromise (IOCs), and turn the findings into detections.

Focus Areas

  • Malware reverse engineering & behavior analysis
  • Windows kernel & internals — drivers, memory, injection techniques (studied from the defender's side)
  • EDR / endpoint monitoring & detection engineering
  • System & process integrity verification

Tech Stack

C C++ Python Windows

Tools: IDA Pro · x64dbg · WinDbg · Ghidra · Wireshark · Sysinternals Suite

GitHub Stats

malwarelens's GitHub stats Top Langs

Contact

All research is conducted for defensive purposes in an isolated environment.

Pinned Loading

  1. drvscan drvscan Public

    Forked from ekknod/drvscan

    scan system / process integrity

    C++

  2. iMonitorSDK iMonitorSDK Public

    Forked from wecooperate/iMonitorSDK

    系统监控开发套件（sysmon、promon、edr、终端安全、主机安全、零信任、上网行为管理）

    C++

  3. KernelCorridor KernelCorridor Public

    A Windows kernel module that provides kernel-level utilities to user-mode applications.

    C++ 1

  4. ModFinder ModFinder Public

    Forked from Nou4r/ModFinder

    Manual-mapped region detector.

    C++

  5. malware-triage-toolkit malware-triage-toolkit Public

    Automated static triage for malware analysis — hashes, strings, IOC extraction, PE parsing and YARA scanning. Static only; never executes samples.

    Python

  6. revlab-mcp revlab-mcp Public

    LAN malware reverse-engineering lab exposed as MCP tools — sample vault, static triage, x64dbg debugging bridge and Frida monitoring for AI agents. Samples never leave the analysis machine.

    Python