#malcat — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #malcat, aggregated by home.social.
-
FUD CastleLoader
SHA256: b0a6f7afa4877eab5085d49207e26d1d2461d2d61d71a4d406e81e9f30711c5e
C2: goldmanadv[.]comRight now, I open in #malcat, save the CAB file to disk, extract the CAB; ripgrep for the C2. Works but could be better, right?
1/2 -
FUD CastleLoader
SHA256: b0a6f7afa4877eab5085d49207e26d1d2461d2d61d71a4d406e81e9f30711c5e
C2: goldmanadv[.]comRight now, I open in #malcat, save the CAB file to disk, extract the CAB; ripgrep for the C2. Works but could be better, right?
1/2 -
We had 9 LLMs battle on real-world #malware triage and static unpacking tasks, using only #Malcat MCP server.
We compared not only their results, but also their speed and cost.
Full write-up:
https://malcat.fr/blog/benchmarking-llms-for-malware-triage-and-static-unpacking-with-malcat/ -
We had 9 LLMs battle on real-world #malware triage and static unpacking tasks, using only #Malcat MCP server.
We compared not only their results, but also their speed and cost.
Full write-up:
https://malcat.fr/blog/benchmarking-llms-for-malware-triage-and-static-unpacking-with-malcat/ -
#Malcat 0.9.14 is out!
This is a maintenance build, with some bonuses:
● AccessDB parsing
● RAR unpacking
● UPX (static) unpacking
● Improved __noreturn detection
● ... and as usual, up-to-date signature, constants and Kesakode DBs.Happy reversing!
-
#Malcat 0.9.14 is out!
This is a maintenance build, with some bonuses:
● AccessDB parsing
● RAR unpacking
● UPX (static) unpacking
● Improved __noreturn detection
● ... and as usual, up-to-date signature, constants and Kesakode DBs.Happy reversing!
-
FUD CastleLoader signed "INFOTECK SOLUTIONS PRIVATE LIMITED"
The 40MB exe makes it hard for detection engines to see the 1 important line of python it will execute. Short #malcat investigation though.
62a6e64a7233f4a756d01c54840ff703a620a416929d57eebc0bdac3b9ed2019
1/3 -
FUD CastleLoader signed "INFOTECK SOLUTIONS PRIVATE LIMITED"
The 40MB exe makes it hard for detection engines to see the 1 important line of python it will execute. Short #malcat investigation though.
62a6e64a7233f4a756d01c54840ff703a620a416929d57eebc0bdac3b9ed2019
1/3 -
#malcat 0.9.12 is out!
Enjoy .pyc and .net stack analysis, py 3.14 support, nuitka / inno 6.7 / .net singlefile bundle parsers and may other improvements:
https://malcat.fr/blog/0912-is-out-python-314-pyc-and-net-stack-analysis/
-
#malcat 0.9.12 is out!
Enjoy .pyc and .net stack analysis, py 3.14 support, nuitka / inno 6.7 / .net singlefile bundle parsers and may other improvements:
https://malcat.fr/blog/0912-is-out-python-314-pyc-and-net-stack-analysis/
-
The malware is an NSIS installer. With #malcat, we can click into the NSIS Installer's compressed object to expand it and see its contents. These contents are compressed, which is what makes a YARA rule practically impossible.
Video showing expanding the NSIS contents
3/7 -
The malware is an NSIS installer. With #malcat, we can click into the NSIS Installer's compressed object to expand it and see its contents. These contents are compressed, which is what makes a YARA rule practically impossible.
Video showing expanding the NSIS contents
3/7 -
The malware is an NSIS installer. With #malcat, we can click into the NSIS Installer's compressed object to expand it and see its contents. These contents are compressed, which is what makes a YARA rule practically impossible.
Video showing expanding the NSIS contents
3/7 -
The malware is an NSIS installer. With #malcat, we can click into the NSIS Installer's compressed object to expand it and see its contents. These contents are compressed, which is what makes a YARA rule practically impossible.
Video showing expanding the NSIS contents
3/7 -
Running the rule against a file will only tell me that it matched, but not what matched, so I load it into #malcat.
Malcat comes with a lot of YARA rules already but there is a user directory too which allows you to add your own and ensure they persist across updates.
4/10 -
Running the rule against a file will only tell me that it matched, but not what matched, so I load it into #malcat.
Malcat comes with a lot of YARA rules already but there is a user directory too which allows you to add your own and ensure they persist across updates.
4/10 -
With #malcat, or other tools, a reverse engineer can investigate those function blocks to understand what they are any why they are unique. For me, I can use this rule for hunting across an environment if desired.
https://github.com/Squiblydoo/100DaysofYARA/blob/main/Squiblydoo/Day10.yara
5/5 -
With #malcat, or other tools, a reverse engineer can investigate those function blocks to understand what they are any why they are unique. For me, I can use this rule for hunting across an environment if desired.
https://github.com/Squiblydoo/100DaysofYARA/blob/main/Squiblydoo/Day10.yara
5/5 -
This scripts are deceptive as they contain 10,000 empty lines. BTW #malcat loads scripts like these better than most text editors.
If I get the chance, I may revise it to see how to find ones without the matching text or if you have ideas, hmu.
https://github.com/Squiblydoo/100DaysofYARA/blob/main/Squiblydoo/Day9.yara
3/3 -
This scripts are deceptive as they contain 10,000 empty lines. BTW #malcat loads scripts like these better than most text editors.
If I get the chance, I may revise it to see how to find ones without the matching text or if you have ideas, hmu.
https://github.com/Squiblydoo/100DaysofYARA/blob/main/Squiblydoo/Day9.yara
3/3 -
For making the rule, I again used #malcat. I highlighted the smaller icon and added it to the YARA rule: "right-click" > "add selection to YARA" > "New rule". Couldn't be easier.
https://github.com/Squiblydoo/100DaysofYARA/blob/main/Squiblydoo/Day2.yara
4/4 -
For making the rule, I again used #malcat. I highlighted the smaller icon and added it to the YARA rule: "right-click" > "add selection to YARA" > "New rule". Couldn't be easier.
https://github.com/Squiblydoo/100DaysofYARA/blob/main/Squiblydoo/Day2.yara
4/4 -
Learn how to deobfuscate #Latrodectus using #malcat's scripting engine:
https://malcat.fr/blog/malcat-scripting-tutorial-deobfuscating-latrodectus/
-
#Malcat tip #10: analysing backdoored clean software can be hard.
A quick win is to pivot around known constants, thanks to Malcat's 400k+ constants DB (here a #Tropidoor dlder):
-
First steps with #malcat? Here is a tutorial video, courtesy of @invokereversing :
-
First steps with #malcat? Here is a tutorial video, courtesy of @invokereversing :
-
If you need to identify #malware quickly, give #malcat a try: its Kesakode code identification is fast and can even work offline!
More info: https://doc.malcat.fr/analysis/kesakode.html
-
You can now check your strings in #malcat against an online library of #Malpedia FLOSSed strings. Just copy this plugin:
https://github.com/malpedia/malpedia-flossed?tab=readme-ov-file#plugin-for-malcat
-
#Malcat 0.9.10 is out! State-of-the-art CFG recovery, MIPS disassembler & decompiler and many UI improvements;
https://malcat.fr/blog/0910-is-out-cfg-recovery-mips-ui-improvements
-
You'll soon be able to export #malcat's view to files:
● Summary report as HTML+ SVG
● Proximity & call graph views as SVG or PNG
● Struct/hex/disasm views as HTML
● Strings, symbols, intel, kesakode and other views as CSV -
#malcat tip #8: fast unpacking of RTF payloads:
https://malcat.fr/blog/malcat-tip-fast-unpacking-of-rtf-payloads/
-
We have released #malcat version 0.9.6, which comes with a new #malware identification service: #Kesakode!
● Works on unpacked malware
● 2000+ malware families & millions of clean + libs in DB
● Only hashes are sent
● Included in Malcat full & proGive it a try!
https://malcat.fr/blog/096-is-out-kesakode-malware-identification/ -
#Malcat version 0.9.5 is out!
You can now unpack & disassemble #InnoSetup installers, download samples from threat intel providers and enjoy an improved user interface.
Last but not least: Debian 12 package!
More info here:
https://malcat.fr/blog/095-is-out-innosetup-new-gui-dialogs-threat-intel-and-more/
-
Tip of the week #4: #malcat can compare 2 binaries using either a 1-to-1 algorithm or Myers's algorithm, a diff algorithm used in bioinformatics.
The later can realign and spot added/substracted bytes.More info there: https://doc.malcat.fr/ui/files.html#compare-two-files
-
Tip of the week #1: #malcat can identify more than 8000 standard Windows GUIDs, both as ascii text or in binary form (MS-encoded).
You can browse all GUIDs in the data panel (under "constants/guid") or in the symbol view (F5 -> Data).