02 / SECURITY / ANALYSIS
SpectreFlow.
Following the traces a threat leaves behind. Static analysis, runtime behavior, and intelligence in one place.
Developer · Genesys 2.0 hackathon
Python · Radare2 · YARA · Docker · NetworkX
THE STARTING POINT
A problem worth exploring.
A suspicious executable rarely tells its story through a single signal. SpectreFlow combines file structure, runtime behavior, and known-threat intelligence to make that story easier to investigate.
THE APPROACH
From question to implementation.
- 01
Integrated Radare2 to generate control flow graphs and YARA rules to detect patterns associated with ransomware, keyloggers, and anti-debugging behavior.
- 02
Combined static inspection with process, network, and filesystem monitoring. Docker provides the isolated analysis environment for Linux targets.
- 03
Added hash-based lookups against VirusTotal and MalwareBazaar to bring external threat intelligence into the analysis workflow.
- 04
Built a Tkinter dashboard for live logs, risk scoring, and interactive graph visualization, alongside a CLI and JSON reporting.
WHERE IT LED
What came out of it.
A hackathon-built malware analysis suite that connects multiple kinds of evidence in a single workflow. Developed for the Genesys 2.0 hackathon at PES University.
Explore the code and documentation