Tag: DFIR

Unpacking ATT&CK With MalChela v4.4

DFIR, Mac, Malware, MITRE ATT&CK, open-source, REMnux, Rust, SIgma, Triage, yara

I came home from ATT&CKcon with a full notebook and a head full of technique IDs. So, fair warning: this release is on a bit of a MITRE kick. But it’s not the only thing in here. v4.4 has three headliners: a brand-new unpacker, ATT&CK mapping across the whole toolkit, and a move to YARA-X that makes installing MalChela a lot less painful.

Unpack

This one came straight out of conversations at the conference.

@dwmetz How can I extract the details strings from packed malware sample. Can Malchela support malware unpacked feature?

Up to now the honest answer was “go get another tool.” Not anymore.

Unpack detects packers, installers, and bundlers in PE, ELF, and Mach-O files and pulls out the payload statically. It never runs the sample. Every call it makes comes with the evidence behind it, and anything it recovers goes right back through Unpack again, so a dropper inside an installer inside a UPX stub comes out as a layer tree instead of just the outer shell.

  • UPX, including the mangled headers Mirai and friends use to make upx -d give up. Unpack repairs a working copy and records every byte it touched.
  • PyInstaller, and then it keeps going into the Python bytecode itself (3.7 through 3.14), peeling off the obfuscation wrappers stealers love: xz, zlib, base64, rot13, the works. The strings land in mStrings automatically.
  • .NET / Costura resources, NSIS, Inno Setup, fat Mach-O, overlays, and executables embedded in other executables.

Point Analyze at a packed sample and Unpack kicks in on its own. Everything it recovers gets the full MalChela treatment. Running a LunaGrabber build through it was a good test: an obfuscated entry script three layers deep, and out came the Discord webhook it exfiltrates to.

MITRE All the Things

Between Unpack, the Mac tools, File Miner, and Analyze, a single run can turn up ATT&CK findings from a dozen files and half a dozen tools. Reading those as a list gets old fast. So now every Analyze run plots them on the Enterprise matrix.

  • Tiles are shaded by how many files hit them. Click one and you get the evidence: which rule, which tool, which file, and the strings that matched.
  • Open the matrix for any saved case, and it pulls in every Analyze run and every standalone tool report in that case. Older cases work too.
  • Every run also saves an ATT&CK Navigator layer, so you can take it straight into Navigator.
  • Everything is on ATT&CK v20: Stealth and Defense Impairment instead of the retired Defense Evasion, and revoked techniques remapped.
  • Click a technique ID in mStrings and the built-in MITRE Lookup opens right there. (Cmd/Ctrl-click still takes you to attack.mitre.org.)

YARA-X

If you’ve ever installed MalChela on a Mac, you know the dance: brew install yara, then export YARA_LIBRARY_PATH, then BINDGEN_EXTRA_CLANG_ARGS, then hope. That’s all gone. Every MalChela tool now runs on YARA-X, VirusTotal’s Rust rewrite of YARA, compiled right in. No libyara, no bindgen, no OpenSSL. On Linux the prerequisites are now build-essential and pkg-config. On a Mac it’s the Xcode command line tools.

It also clears the biggest roadblock to running MalChela natively on Windows. WSL2 is still the supported route for now, but native Windows testing is next on my list.

A huge thank-you to Daniel Iwugo (@elementmerc), who did the groundwork on the new YARA backend and closed the gaps between it and libyara. This is what open source is supposed to look like.

YARA Scan

With the engine built in, it would have been silly not to expose it. YARA Scan is a new tool for running your own rules against a file or folder, and it speaks the same language as VirusTotal’s yr scan: same flags, same output. I tested it side by side with yr on the full signature-base rule set and got identical results. It saves reports to your case, and there’s a simplified panel in the web interface. For the deeper yr features like compiled rules and module data, the YARA-X integration is still there.

IP Reputation and GreyNoise

Threat Intel Query now looks up IP addresses on VirusTotal, AlienVault OTX, and, new in this release, GreyNoise. There’s a new IP tab, and defanged input is fine. The part I like best: an IP being “found” doesn’t mean much on its own, since 8.8.8.8 is in every source there is. So instead of FOUND, each source tells you what it actually concluded: flagged, clean, a known benign service, or a scanner. Analyze runs the same lookups on the IPs it finds.

mStrings got smarter about IPs too. When dozens of addresses are stored together, like a sandbox blocklist or a C2 pool, they’re reported as one list instead of fifty separate “C2” hits.

Odds and Ends

  • The Analyze summary now follows the structure of Lenny Zeltser’s Malware Analysis Report template, and the template is built into the MCP plugin, so Claude can write the full report and save it to your case.
  • mStrings recognizes encoded string tables. AMOS keeps its whole AppleScript as about 1,900 encoded strings; now you get one clear finding instead of a wall of matches.
  • The API Keys panel has a slot for GreyNoise, and At a Glance counts all 21 tools.
  • The docs and the PDF user guide are up to date, with new pages for Unpack and YARA Scan.
Grab the latest MalChela release
Read the Docs

From Strings to Techniques: Catch Me at ATT&CKcon 7.0

DFIR, Malware, MITRE ATT&CK, Presentations, SIgma

I’m excited to share that I’ll be speaking at MITRE ATT&CKcon 7.0, October 27–28, 2026, at MITRE in McLean, VA and online.

My talk, From Strings to Techniques: AI-Augmented Malware Analysis with MalChela and Claude Desktop, looks at what happens when you give an AI co-analyst real tools instead of just a chat window. Using MalChela’s MCP server integration with Claude Desktop, I’ll walk through a workflow that goes from raw string extraction to ATT&CK-mapped findings, synthesizes results across multiple tools, and ends with something defenders can actually use: detection content.

Expect a practical look at:

  • ATT&CK-mapped string analysis with mStrings, turning noise into techniques
  • Cross-tool synthesis, letting the co-analyst correlate output from tiquery, fileanalyzer, and more
  • Closing the loop, from static analysis to YARA and Sigma rules ready for detection engineering

If you’re going to be in McLean, come say hello. I’m always up for talking DFIR, malware, open-source tooling, or where AI fits (and doesn’t) in our workflows. If you can’t make the trip, ATT&CKcon offers virtual attendance, so you can still catch the talk and the rest of a great lineup.

Register for ATT&CKcon 7.0

If you’d like to get a head start, MalChela is available on GitHub. See you there!

MalChela v4.3

DFIR, Mac, Malware, MITRE ATT&CK, open-source, REMnux, Rust, SIgma, Triage

Hot on the heels of v4.2… yep, v4.3. What can I say? The melatonin isn’t cutting it anymore to keep me asleep. Rather than count sheep – working on my favorite project helps. Granted I’ve still got bags under my eyes, but I’ve got something to show for it.

At A Glance

The first thing you’ll notice on this release, after all it’s impossible to miss, the At A Glance panel added to the Home Screen. In addition to the “Crabby Koans“, you see:

  • Number of open/closed cases
  • API key status
  • Number of MalChela tools loaded
  • Number of Integrations (3rd party tools) loaded; great for REMnux mode
  • GitHub status for available updates (it’s back!)

Other UI enhancements include new Analyze and Cases toolbar buttons, a collapsible Tools sidebar; and live progress updates during a run.

Airplane Mode / Offline Mode

While there’s a lot of great threat-intel information you can garner using TIQuery and the other utilities, sometimes internet isn’t an option – or maybe it’s a sample you want to handle so carefully you want to ensure there’s no external lookup activity. MalChela won’t mess with your Op-Sec. Rather than just have things fail gracefully (hopefully) when there’s no internet, there’s now a new Offline Mode toggle (Configuration screen), that cleanly skips every network call across the toolkit (NSRLQuery, TIQuery’s full multi-source lookup, FileAnalyzer’s VirusTotal + NSRL checks) instead of failing quietly or hanging, so labs and scenarios can run fully air-gapped.

Analyze Rollup

  • Triage Summary now links directly to the relevant section for flagged malicious files and their flags/indicators, plus the Filesystem and Network IOC lists — click a finding, jump straight to the detail.
  • Network IOCs in the rollup are shown defanged by default, with a note clarifying that links jump to the report section rather than the live URL.
  • Case ZIP/archive samples and containers found mid-scan (not just top-level) are now auto-extracted and analyzed automatically.
  • Includes the new dpp Extract tool: unwraps DMG/PKG containers to reach the real payload files inside.

mStrings

As the tools and the suite continue to grow, mStrings remains the star of the show. Updates in this release include:

  • Network IOCs in mStrings’ own report output are now defanged, matching the rollup.
  • Base64 strings are now auto-decoded and recursively rescanned for further IOCs/detections.
  • Regex engine switched to fancy-regex, enabling lookaround-based detection patterns.
  • Better surfacing of bare-domain C2 IOCs and multi-layer obfuscation depth.

The Base64 scanning is impressive. On one of my test samples MalChela was able to extract strings in a file buried under 8 layers of Base64 encapsulation.

StringsToYARA

  • New refang capability: defanged URLs (hxxp://, [.]) in source strings are automatically restored to real URLs in the generated YARA rule.

Safely store your URLs in a defanged state – when it’s time to create the rule – then and only then does the live url get exposed.

Detections

  • 25 new detection rules added (bringing the ruleset to 144), including full coverage for the Proton macOS RAT family, XCSSET, iWorm, EmPyre, Bella RAT, BirdMiner, and Python self-decompressing execution patterns.

Documentation

  • Full documentation pass covering all of the above, plus a new Offline Mode reference page and a Top Toolbar quick-reference table.
  • Bonus for me, the PDF User Guide is now generated via an automated, versioned build pipeline.
Grab the latest MalChela release
Read the Docs

MalChela 4.2 Release

Automation, DFIR, Mac, Malware, MITRE ATT&CK, open-source, Rust, SIgma, Triage

I’m excited to announce that v4.2 of MalChela is now available. While it may not be “the Answer to the Ultimate Question of Life, the Universe, and Everything,” or even The Malware Analysts Guide to the Galaxy, it does have some great new functionality.

This release has two big themes. First, the Mac side of the house — four tools now speak fluent .app bundle instead of making you dig out the binary inside Contents/MacOS/ yourself.

Second, and bigger: there’s a new way to run MalChela that doesn’t start with “which tool do I need for this file again?” It’s called Analyze, and it’s the closest thing this project has had to a an easy button.

Mac app bundle support (“Mac Stack”)

If you’ve ever pulled a .app bundle into MalChela before, you know the drill: find the actual binary buried in Contents/MacOS/, feed that to whatever tool you’re running, and hope you resolved the right one. That workaround is gone. Four tools now understand .app bundles directly — point macho_info, codesign_check, mstrings, or plist_analyzer at the bundle itself and they auto-resolve the main executable (via CFBundleExecutable, falling back to the sole binary in Contents/MacOS/ when needed).

What each one is actually looking for:

  • macho_info — architecture, PIE/ASLR, __PAGEZERO, linked libraries, per-section entropy. It flags deprecated/EOL crypto libraries, RPATH entries (a classic dylib-hijacking setup), and the CoreFoundation+SystemConfiguration+Security dylib triad that shows up disproportionately often in C2 implants.
  • codesign_check — signature status (Developer-signed / Ad-hoc / Unsigned), Bundle ID, Team ID, entitlements, and the get-task-allow flag (a tell for debug builds). It also catches Team ID mismatches between a bundle’s signer and its main executable’s signer — a supply-chain / hijack indicator that’s easy to miss by eye.
  • plist_analyzer — flags LSUIElement/NSUIElement (an app hiding itself from the Dock), NSAllowsArbitraryLoads (App Transport Security turned off), custom CFBunda missing CFBundleSignature, and missing orextra binaries inside Contents/MacOS/.
  • mstrings — now scans Mach-O binaries and bundles directly, with the same bundle-to-executable auto-resolution as the rest of the stack.

More Mac-specific detections are already in the pipeline for upcoming releases, so consider this the foundation, not the ceiling.

Analyze — one-click auto-triage

Point Analyze at a file, a folder, or a .app bundle, and it classifies everything with FileMiner, then automatically dispatches every tool FileMiner suggests for each file it finds. No more running FileMiner, reading the suggested-tools column, and manually kicking off each one yourself — Analyze closes that loop for you. It’s available in both the PWA and as a new analyze tool in the MCP server, so if you’re driving MalChela through Claude, the same triage workflow is one call away.

A couple of details worth knowing:

  • Save to Case works exactly like every other tool panel — checkbox plus case dropdown, opt-in. On the MCP side, it follows the same rule as every other MCP tool: you need an active case (set_case) before Analyze will run, which keeps the behavior consistent across the whole server rather than special-casing this one workflow.
  • Concise Output is on by default and renders the rollup report inline instead of the full expanded per-tool output — good default for a first pass, and easy to turn off if you want to see everything each tool produced.

The MalChela Summary rollup report

Every Analyze run produces one malchela_summary_<timestamp>.md, saved alongside the individual tool reports it’s summarizing. The goal here wasn’t just “concatenate the output” — it’s a real triage document, and it leads with a summary banner built to answer the questions you’d actually ask first:

  • How many files, really? File counts, with automatic grouping of duplicate content — if the same bytes show up under five different filenames (extremely common with carved or exported artifacts), you get one write-up instead of five identical ones.
  • Is anything flagged? Malicious verdicts pulled from VirusTotal, cross-referenced across both FileAnalyzer and tiquery — which matters more than it sounds like, since FileAnalyzer isn’t run against Mach-O files, so tiquery is what keeps Mac samples from falling through the cracks.
  • What is it? Malware family and tag names pulled straight from tiquery’s multi-source lookups.
  • What does it do? MITRE ATT&CK findings from mstrings, totaled and broken down by tactic, so you can see at a glance whether you’re looking at something built for persistence, defense evasion, discovery, or all of the above.
  • What did it touch or talk to? Filesystem and network IOCs surfaced by mstrings.
  • What’s structurally off? Flags and indicators from macho_info, plist_analyzer, and codesign_check — the RPATH entries, hidden-Dock plists, and Team ID mismatches mentioned above, all rolled up in one place.

Below the summary, each file gets its own section with every tool’s actual formatted report embedded — real tables, real headers, not a wall of raw console output. It reads cleanly whether you’re looking at it in the PWA or opening the file on its own.

Douglas Adams never actually tells us what the Question is — just the Answer. v4.2 doesn’t have that problem. The question was always “what’s actually in this sample,” and now Analyze, the Mac Stack, and the MalChela Summary answer it in one pass instead of five.

Pull the release, point Analyze at something, and see what the rollup finds. Don’t forget your towel. https://github.com/dwmetz/MalChela/releases/tag/v4.2