Rootkit Hunter alternatives

Looking for a better tool, or simply want to learn about alternatives? There is typically more than one option.

Alternatives (by tag)

67

Alternative: chkrootkit

chkrootkit is a malware scanner to locally check for signs of a rootkit. It is written in shell script and runs on the host system itself.

The chkrootkit tool consists of multiple parts that may detect the presence of rootkit parts of rootkit behavior on a system.

Some areas that are checked include:

  • interface in promiscuous mode
  • lastlog deletions
  • wtmp deletions
  • wtmpx deletions
  • signs of LKM trojans
  • utmp deletions

Project details

chkrootkit is written in C, shell script.

Strengths

  • + Used language is shell script
  • + Project is mature (10+ years)

Weaknesses

  • - Long time between releases

Typical usage

  • malware scan

chkrootkit project page

81

Alternative: ClamAV

ClamAV is an open source antivirus engine. It can detect malicious software (malware) like trojans, viruses, backdoors and other related threats.

ClamAV is a popular scan engine to detect malicious software (malware).

Project details

ClamAV is written in C.

Strengths

  • + Many maintainers
  • + The source code of this software is available

Typical usage

  • malware scan

ClamAV project page

64

Alternative: EvilAbigail

Evil Abigail automates a so-called evil maid attack. It does so by backdooring the initial ramdisk (initrd) of Linux systems.

60

Alternative: WeBaCoo

WeBaCoo is short for Web Backdoor Cookie Script-Kit. It is a tool to get a backdoor that is controlled by a specified cookie.

Project details

WeBaCoo is written in Perl, Ruby.

Strengths

  • + The source code of this software is available

Typical usage

  • application testing
  • penetration test

WeBaCoo project page

56

Alternative: bingrep

Bingrep is a utility that can be described as the 'grep for binaries'. It runs on Linux and helps with reverse engineering and malware analysis.

Searches through binaries and highlights the most important areas with colors.

Supported binary formats:

  • ELF 32/64, arm, x86, openrisc
  • Mach 32/64, arm, x86
  • PE

96

Alternative: Cuckoo Sandbox (cuckoo)

Cuckoo Sandbox is a malware analysis system. By feeding it suspicious files, Cuckoo can provide detailed findings on what a file did and how it behaved.

In a matter of seconds, Cuckoo Sandbox provides detailed results on what a file does within an isolated environment. This helps with malware analysis and understanding what it exactly tries to achieve. Further analysis can be done, based on the previous actions that were done.

Cuckoo Sandbox was created by Claudio Guarnieri as part of the Google Summer of Code project in 2010.

Project details

Cuckoo Sandbox is written in Python.

Strengths

  • + More than 2000 GitHub stars
  • + The source code of this software is available

Weaknesses

  • - Many provided pull requests are still open
  • - Many reported issues are still open

Typical usage

  • digital forensics
  • malware analysis

Cuckoo Sandbox project page

64

Alternative: Diamorphine

Diamorphine is a so-called LKM rootkit for Linux. It runs on different kernels in the 2.6, 3.x, and 4.x branch.

Project details

Diamorphine is written in C.

Strengths

  • + The source code of this software is available

Typical usage

  • learning

Diamorphine project page

97

Alternative: hBlock

hBlock is a security tool to protect against advertisements, trackers, and malware. It does so by altering the /etc/hosts file and block bad or malicious hosts.

Project details

hBlock is written in shell script.

Strengths

  • + Used language is shell script
  • + The source code of this software is available

Typical usage

  • malware protection
  • privacy enhancement

hBlock project page

96

Alternative: LMD

Linux Malware Detect (LMD) is a malware scanner for systems running Linux. The open source software project is released with the GPLv2 license.

LMD uses MD5 file hashes and HEX pattern matches to define the malware signatures. These are used to detect malware.

Project details

LMD is written in shell script.

Strengths

  • + The source code of this software is available

Typical usage

  • malware scan

LMD project page

74

Alternative: Malscan

Malscan is a tool that sells itself as the robust ClamAV-based malware scanner for web servers. It can use signatures from multiple sources to perform scanning.

Malscan has multiple sources for its malware signatures:

  • RFX Networks Signatures
  • Metasploit Signatures
  • Malscan Signatures
  • ClamAV Main Signatures

Detection methods include HEX or MD5 matches, string length (e.g. base64), and MimeType mismatches.

Project details

Malscan is written in shell script.

Strengths

  • + Used language is shell script
  • + The source code of this software is available

Typical usage

  • malware scan

Malscan project page

70

Alternative: Viper

Viper is a binary analysis and management framework for security researchers. It provides a way to organization your collection of malware samples and exploits.

Viper organizes the malware samples and exploits you found over time. It calls itself "Metasploit for malware researchers". Viper has a terminal interface to store, search and analyze files. As it is a framework, is also allows you to create your plugins.

84

Alternative: yarGen

The yarGen utility helps with creating YARA rules for malware detection. It can combine both 'goodware' and 'malware', to properly craft the right rules.

93

Alternative: Loki

Loki is security tool to find so-called indicators of compromise (IOC). It does this by scanning files and then uses pattern matching.

Project details

Loki is written in Python.

Strengths

  • + Commercial support available
  • + More than 10 contributors
  • + More than 500 GitHub stars
  • + The source code of this software is available

Typical usage

  • digital forensics
  • intrusion detection
  • security monitoring

Loki project page

64

Alternative: Maltrail

Maltrail monitors for traffic on the network that might indicate system compromise or other bad behavior. It is great for intrusion detection and monitoring.

Project details

Maltrail is written in Python.

Strengths

  • + The source code of this software is available

Weaknesses

  • - More than 10 contributors
  • - More than 2000 GitHub stars

Typical usage

  • intrusion detection
  • network analysis
  • security monitoring

Maltrail project page

64

Alternative: PHP Malware Finder

PHP Malware Finder is a tool to find malicious PHP scripts. This threat is common for most web hosters and websites of their customers.

Project details

PHP Malware Finder is written in shell script.

Strengths

  • + More than 500 GitHub stars
  • + The source code of this software is available

Typical usage

  • malware scan

PHP Malware Finder project page

97

Alternative: YARA

YARA is a security tool to help malware researchers to identify and classify malware samples. For example by defining malware families based on patterns.

Project details

YARA is written in C.

Strengths

  • + More than 50 contributors
  • + More than 1000 GitHub stars

Typical usage

  • malware analysis
  • malware scan

YARA project page

68

Alternative: Azazel

Azazel is a Linux rootkit that uses the LD_PRELOAD technique to intercept system calls. Rootkits are a type of malicious software (malware).

Project details

Azazel is written in C.

Strengths

  • + The source code of this software is available

Typical usage

  • malware analysis

Azazel project page