These are tools discussed Learning Ransomware Response & Recovery by W. Curtis Preston and Dr. Mike Saylor. Browse the list of all tools or get the book.
Inclusion in this directory does not indicate endorsement.
If you see a missing tool, leave a comment!
These tools help identify ransomware variants, analyze malware behavior in safe environments, and locate available decryption tools for known ransomware families.
Free Identification Tools
- VirusTotal – https://www.virustotal.com – Multi-engine malware scanner (60-70 engines)
- NoMoreRansom.org – https://www.nomoreransom.org – Europol database of free decryptors (100+ variants)
- ID Ransomware – https://id-ransomware.malwarehunterteam.com – Ransomware identification via upload (MalwareHunterTeam)
- CISA StopRansomware.gov – https://www.cisa.gov/stopransomware – U.S. government ransomware resources
- CISA Cyber Hygiene Scanner – https://www.cisa.gov/cyber-hygiene-services – Free vulnerability scanning for SMBs
Sandbox Environments (Free)
- Hybrid Analysis – https://www.hybrid-analysis.com – Cloud-based malware sandbox
- ANY.RUN – https://any.run – Interactive malware analysis sandbox
- Cuckoo Sandbox – https://cuckoo.cert.ee – Open-source automated malware analysis
- Joe Sandbox – https://www.joesandbox.com – Cloud-based sandbox (has free tier)
Sandbox Environments (Commercial)
- AttackIQ – https://www.attackiq.com – Automated security validation platform
- SafeBreach – https://safebreach.com – Breach and attack simulation platform
Reverse Engineering Tools
Free
- Ghidra – https://ghidra-sre.org – NSA’s free reverse engineering tool
- Radare2 – https://www.radare.org – Open-source reverse engineering framework
Commercial
- IDA Pro – https://hex-rays.com/ida-pro – Industry-standard disassembler and debugger
Malware Scanning
- Malwarebytes – https://www.malwarebytes.com – Malware scanning with free and paid versions