Category: open-source

Unpacking ATT&CK With MalChela v4.4

DFIR, Mac, Malware, MITRE ATT&CK, open-source, REMnux, Rust, SIgma, Triage, yara

I came home from ATT&CKcon with a full notebook and a head full of technique IDs. So, fair warning: this release is on a bit of a MITRE kick. But it’s not the only thing in here. v4.4 has three headliners: a brand-new unpacker, ATT&CK mapping across the whole toolkit, and a move to YARA-X that makes installing MalChela a lot less painful.

Unpack

This one came straight out of conversations at the conference.

@dwmetz How can I extract the details strings from packed malware sample. Can Malchela support malware unpacked feature?

Up to now the honest answer was “go get another tool.” Not anymore.

Unpack detects packers, installers, and bundlers in PE, ELF, and Mach-O files and pulls out the payload statically. It never runs the sample. Every call it makes comes with the evidence behind it, and anything it recovers goes right back through Unpack again, so a dropper inside an installer inside a UPX stub comes out as a layer tree instead of just the outer shell.

  • UPX, including the mangled headers Mirai and friends use to make upx -d give up. Unpack repairs a working copy and records every byte it touched.
  • PyInstaller, and then it keeps going into the Python bytecode itself (3.7 through 3.14), peeling off the obfuscation wrappers stealers love: xz, zlib, base64, rot13, the works. The strings land in mStrings automatically.
  • .NET / Costura resources, NSIS, Inno Setup, fat Mach-O, overlays, and executables embedded in other executables.

Point Analyze at a packed sample and Unpack kicks in on its own. Everything it recovers gets the full MalChela treatment. Running a LunaGrabber build through it was a good test: an obfuscated entry script three layers deep, and out came the Discord webhook it exfiltrates to.

MITRE All the Things

Between Unpack, the Mac tools, File Miner, and Analyze, a single run can turn up ATT&CK findings from a dozen files and half a dozen tools. Reading those as a list gets old fast. So now every Analyze run plots them on the Enterprise matrix.

  • Tiles are shaded by how many files hit them. Click one and you get the evidence: which rule, which tool, which file, and the strings that matched.
  • Open the matrix for any saved case, and it pulls in every Analyze run and every standalone tool report in that case. Older cases work too.
  • Every run also saves an ATT&CK Navigator layer, so you can take it straight into Navigator.
  • Everything is on ATT&CK v20: Stealth and Defense Impairment instead of the retired Defense Evasion, and revoked techniques remapped.
  • Click a technique ID in mStrings and the built-in MITRE Lookup opens right there. (Cmd/Ctrl-click still takes you to attack.mitre.org.)

YARA-X

If you’ve ever installed MalChela on a Mac, you know the dance: brew install yara, then export YARA_LIBRARY_PATH, then BINDGEN_EXTRA_CLANG_ARGS, then hope. That’s all gone. Every MalChela tool now runs on YARA-X, VirusTotal’s Rust rewrite of YARA, compiled right in. No libyara, no bindgen, no OpenSSL. On Linux the prerequisites are now build-essential and pkg-config. On a Mac it’s the Xcode command line tools.

It also clears the biggest roadblock to running MalChela natively on Windows. WSL2 is still the supported route for now, but native Windows testing is next on my list.

A huge thank-you to Daniel Iwugo (@elementmerc), who did the groundwork on the new YARA backend and closed the gaps between it and libyara. This is what open source is supposed to look like.

YARA Scan

With the engine built in, it would have been silly not to expose it. YARA Scan is a new tool for running your own rules against a file or folder, and it speaks the same language as VirusTotal’s yr scan: same flags, same output. I tested it side by side with yr on the full signature-base rule set and got identical results. It saves reports to your case, and there’s a simplified panel in the web interface. For the deeper yr features like compiled rules and module data, the YARA-X integration is still there.

IP Reputation and GreyNoise

Threat Intel Query now looks up IP addresses on VirusTotal, AlienVault OTX, and, new in this release, GreyNoise. There’s a new IP tab, and defanged input is fine. The part I like best: an IP being “found” doesn’t mean much on its own, since 8.8.8.8 is in every source there is. So instead of FOUND, each source tells you what it actually concluded: flagged, clean, a known benign service, or a scanner. Analyze runs the same lookups on the IPs it finds.

mStrings got smarter about IPs too. When dozens of addresses are stored together, like a sandbox blocklist or a C2 pool, they’re reported as one list instead of fifty separate “C2” hits.

Odds and Ends

  • The Analyze summary now follows the structure of Lenny Zeltser’s Malware Analysis Report template, and the template is built into the MCP plugin, so Claude can write the full report and save it to your case.
  • mStrings recognizes encoded string tables. AMOS keeps its whole AppleScript as about 1,900 encoded strings; now you get one clear finding instead of a wall of matches.
  • The API Keys panel has a slot for GreyNoise, and At a Glance counts all 21 tools.
  • The docs and the PDF user guide are up to date, with new pages for Unpack and YARA Scan.
Grab the latest MalChela release
Read the Docs

MalChela v4.3

DFIR, Mac, Malware, MITRE ATT&CK, open-source, REMnux, Rust, SIgma, Triage

Hot on the heels of v4.2… yep, v4.3. What can I say? The melatonin isn’t cutting it anymore to keep me asleep. Rather than count sheep – working on my favorite project helps. Granted I’ve still got bags under my eyes, but I’ve got something to show for it.

At A Glance

The first thing you’ll notice on this release, after all it’s impossible to miss, the At A Glance panel added to the Home Screen. In addition to the “Crabby Koans“, you see:

  • Number of open/closed cases
  • API key status
  • Number of MalChela tools loaded
  • Number of Integrations (3rd party tools) loaded; great for REMnux mode
  • GitHub status for available updates (it’s back!)

Other UI enhancements include new Analyze and Cases toolbar buttons, a collapsible Tools sidebar; and live progress updates during a run.

Airplane Mode / Offline Mode

While there’s a lot of great threat-intel information you can garner using TIQuery and the other utilities, sometimes internet isn’t an option – or maybe it’s a sample you want to handle so carefully you want to ensure there’s no external lookup activity. MalChela won’t mess with your Op-Sec. Rather than just have things fail gracefully (hopefully) when there’s no internet, there’s now a new Offline Mode toggle (Configuration screen), that cleanly skips every network call across the toolkit (NSRLQuery, TIQuery’s full multi-source lookup, FileAnalyzer’s VirusTotal + NSRL checks) instead of failing quietly or hanging, so labs and scenarios can run fully air-gapped.

Analyze Rollup

  • Triage Summary now links directly to the relevant section for flagged malicious files and their flags/indicators, plus the Filesystem and Network IOC lists — click a finding, jump straight to the detail.
  • Network IOCs in the rollup are shown defanged by default, with a note clarifying that links jump to the report section rather than the live URL.
  • Case ZIP/archive samples and containers found mid-scan (not just top-level) are now auto-extracted and analyzed automatically.
  • Includes the new dpp Extract tool: unwraps DMG/PKG containers to reach the real payload files inside.

mStrings

As the tools and the suite continue to grow, mStrings remains the star of the show. Updates in this release include:

  • Network IOCs in mStrings’ own report output are now defanged, matching the rollup.
  • Base64 strings are now auto-decoded and recursively rescanned for further IOCs/detections.
  • Regex engine switched to fancy-regex, enabling lookaround-based detection patterns.
  • Better surfacing of bare-domain C2 IOCs and multi-layer obfuscation depth.

The Base64 scanning is impressive. On one of my test samples MalChela was able to extract strings in a file buried under 8 layers of Base64 encapsulation.

StringsToYARA

  • New refang capability: defanged URLs (hxxp://, [.]) in source strings are automatically restored to real URLs in the generated YARA rule.

Safely store your URLs in a defanged state – when it’s time to create the rule – then and only then does the live url get exposed.

Detections

  • 25 new detection rules added (bringing the ruleset to 144), including full coverage for the Proton macOS RAT family, XCSSET, iWorm, EmPyre, Bella RAT, BirdMiner, and Python self-decompressing execution patterns.

Documentation

  • Full documentation pass covering all of the above, plus a new Offline Mode reference page and a Top Toolbar quick-reference table.
  • Bonus for me, the PDF User Guide is now generated via an automated, versioned build pipeline.
Grab the latest MalChela release
Read the Docs

MalChela 4.2 Release

Automation, DFIR, Mac, Malware, MITRE ATT&CK, open-source, Rust, SIgma, Triage

I’m excited to announce that v4.2 of MalChela is now available. While it may not be “the Answer to the Ultimate Question of Life, the Universe, and Everything,” or even The Malware Analysts Guide to the Galaxy, it does have some great new functionality.

This release has two big themes. First, the Mac side of the house — four tools now speak fluent .app bundle instead of making you dig out the binary inside Contents/MacOS/ yourself.

Second, and bigger: there’s a new way to run MalChela that doesn’t start with “which tool do I need for this file again?” It’s called Analyze, and it’s the closest thing this project has had to a an easy button.

Mac app bundle support (“Mac Stack”)

If you’ve ever pulled a .app bundle into MalChela before, you know the drill: find the actual binary buried in Contents/MacOS/, feed that to whatever tool you’re running, and hope you resolved the right one. That workaround is gone. Four tools now understand .app bundles directly — point macho_info, codesign_check, mstrings, or plist_analyzer at the bundle itself and they auto-resolve the main executable (via CFBundleExecutable, falling back to the sole binary in Contents/MacOS/ when needed).

What each one is actually looking for:

  • macho_info — architecture, PIE/ASLR, __PAGEZERO, linked libraries, per-section entropy. It flags deprecated/EOL crypto libraries, RPATH entries (a classic dylib-hijacking setup), and the CoreFoundation+SystemConfiguration+Security dylib triad that shows up disproportionately often in C2 implants.
  • codesign_check — signature status (Developer-signed / Ad-hoc / Unsigned), Bundle ID, Team ID, entitlements, and the get-task-allow flag (a tell for debug builds). It also catches Team ID mismatches between a bundle’s signer and its main executable’s signer — a supply-chain / hijack indicator that’s easy to miss by eye.
  • plist_analyzer — flags LSUIElement/NSUIElement (an app hiding itself from the Dock), NSAllowsArbitraryLoads (App Transport Security turned off), custom CFBunda missing CFBundleSignature, and missing orextra binaries inside Contents/MacOS/.
  • mstrings — now scans Mach-O binaries and bundles directly, with the same bundle-to-executable auto-resolution as the rest of the stack.

More Mac-specific detections are already in the pipeline for upcoming releases, so consider this the foundation, not the ceiling.

Analyze — one-click auto-triage

Point Analyze at a file, a folder, or a .app bundle, and it classifies everything with FileMiner, then automatically dispatches every tool FileMiner suggests for each file it finds. No more running FileMiner, reading the suggested-tools column, and manually kicking off each one yourself — Analyze closes that loop for you. It’s available in both the PWA and as a new analyze tool in the MCP server, so if you’re driving MalChela through Claude, the same triage workflow is one call away.

A couple of details worth knowing:

  • Save to Case works exactly like every other tool panel — checkbox plus case dropdown, opt-in. On the MCP side, it follows the same rule as every other MCP tool: you need an active case (set_case) before Analyze will run, which keeps the behavior consistent across the whole server rather than special-casing this one workflow.
  • Concise Output is on by default and renders the rollup report inline instead of the full expanded per-tool output — good default for a first pass, and easy to turn off if you want to see everything each tool produced.

The MalChela Summary rollup report

Every Analyze run produces one malchela_summary_<timestamp>.md, saved alongside the individual tool reports it’s summarizing. The goal here wasn’t just “concatenate the output” — it’s a real triage document, and it leads with a summary banner built to answer the questions you’d actually ask first:

  • How many files, really? File counts, with automatic grouping of duplicate content — if the same bytes show up under five different filenames (extremely common with carved or exported artifacts), you get one write-up instead of five identical ones.
  • Is anything flagged? Malicious verdicts pulled from VirusTotal, cross-referenced across both FileAnalyzer and tiquery — which matters more than it sounds like, since FileAnalyzer isn’t run against Mach-O files, so tiquery is what keeps Mac samples from falling through the cracks.
  • What is it? Malware family and tag names pulled straight from tiquery’s multi-source lookups.
  • What does it do? MITRE ATT&CK findings from mstrings, totaled and broken down by tactic, so you can see at a glance whether you’re looking at something built for persistence, defense evasion, discovery, or all of the above.
  • What did it touch or talk to? Filesystem and network IOCs surfaced by mstrings.
  • What’s structurally off? Flags and indicators from macho_info, plist_analyzer, and codesign_check — the RPATH entries, hidden-Dock plists, and Team ID mismatches mentioned above, all rolled up in one place.

Below the summary, each file gets its own section with every tool’s actual formatted report embedded — real tables, real headers, not a wall of raw console output. It reads cleanly whether you’re looking at it in the PWA or opening the file on its own.

Douglas Adams never actually tells us what the Question is — just the Answer. v4.2 doesn’t have that problem. The question was always “what’s actually in this sample,” and now Analyze, the Mac Stack, and the MalChela Summary answer it in one pass instead of five.

Pull the release, point Analyze at something, and see what the rollup finds. Don’t forget your towel. https://github.com/dwmetz/MalChela/releases/tag/v4.2

MalChela 3.2: More Cowbell? More Intel!

DFIR, Mac, Malware, open-source, Rust, yara

One of the things I value most about the open-source community is that the best improvements to a tool often don’t come from inside it — they come from outside conversations.  A short while back, the author of mlget, xorhex,  reached out and suggested I add more malware retrieval sources to FOSSOR, one of my earlier tools for pulling down samples from threat intel repositories.  It was a generous nudge, and it landed at exactly the right moment.

FOSSOR started as a simple script.  It did one job — grab malware samples from a handful of sources — and it did it well enough.  When I wrote it, I already knew it was a candidate for eventual MalChela integration, but “eventually” had stayed firmly in the future tense.  The message from xorhex gave me the push to actually sit down and do it properly.

The result is tiquery — and it’s become a new centerpiece to MalChela 3.2.

The Pattern I Keep Repeating (Deliberately)

If you’ve followed this blog or the MalChela project for a while, you might notice a recurring arc in how my tools tend to develop.  It goes something like this:

  • Step one:  write a focused script that solves a specific problem.
  • Step two:  that script evolves into a standalone tool as the scope grows.
  • Step three:  the tool finds its permanent home inside MalChela, where it benefits from the broader ecosystem — case management, the GUI, the MCP server integration, the portable workspace.
  • Step four:  When there’s overlap between tools, follow the KISS principle.

FOSSOR was in step one.  The conversation with xorhex accelerated the jump to step three.  What emerged was something more ambitious than just a source expansion — it’s a unified threat intelligence query engine, built from the ground up.

If you’re new to MalChela, it’s a Rust-based malware analysis toolkit built for DFIR practitioners — static analysis, string extraction, YARA rule generation, threat intel lookups, network analysis, and now a unified case management layer tying it all together.  Free, open-source, and built to run anywhere.

Introducing tiquery

tiquery is now the single threat intel tool in MalChela, replacing the retired malhash.  The core idea is straightforward: submit a hash, query multiple sources in parallel, get a clean color-coded summary back.  No waiting for one source to finish before the next one starts.  No manually juggling browser tabs or API wrappers.

Out of the box, tiquery works with eight confirmed sources:

  • VirusTotal
  • MalwareBazaar
  • AlienVault OTX
  • MetaDefender Cloud
  • Hybrid Analysis
  • FileScan.IO
  • Malshare
  • ObjectiveSee (no API key required — queries a locally-cached macOS malware catalogue)

Sources are tiered — free sources and registration-required sources are distinguished in the interface.  If you haven’t configured an API key for a given source, tiquery skips it gracefully rather than throwing an error. This means you can run it easily with whatever keys you have available.

The ObjectiveSee integration deserves a special mention.  It queries the objective-see.org/malware.html catalogue for macOS-specific threats using a locally-cached copy that refreshes every 24 hours, with a stale-cache fallback for offline use.  For anyone doing Mac forensics, this is a meaningful addition — a free, no-key-required check specifically against known macOS malware families.

Tiquery, like FOSSOR, supports batch lookups as well — point it to a .csv or .txt file of hashes and they’ll all be checked in parallel. You can also download samples directly, with MalwareBazaar supported in this release and additional sources on the way – (your vote matters).

What It Looks Like in Practice

The screenshots below show tiquery running in both the CLI and GUI.  In both cases, for any of the matching sources you get a basic classification (malware family, tags, detections,) and direct links to threat intelligence documents about the samples. It’s the perfect jumping off point when you want to leverage community research.

The CLI output is clean and tabular — source abbreviation, status (color-coded FOUND/NOT FOUND), family and tag information, detection count, and a direct reference URL.  Everything you need to make a quick triage decision, no scrolling through API response JSON required. You can run tiquery CLI as a stand-alone, or from within the MalChela CLI menu.

In the GUI, the experience is layered a bit more richly.  You can toggle individual sources on or off, switch between single-hash and bulk lookup modes, download the sample directly from MalwareBazaar, and export results to CSV — all from one interface.  The macOS ObjectiveSee source displays its cache age inline so you always know how fresh the data is.

Both outputs feed into MalChela’s case management system.  Check “Save to Case” in the GUI, and tiquery creates a valid case.json automatically — no separate case creation step needed.

Extended Case Management Across the Toolkit

Speaking of case management — 3.2 extends “Save to Case” support across the full GUI.  File Analyzer, File Miner, and mStrings, all now include the checkbox.  This closes out the last gaps in the case workflow.  Whatever tool you’re using for a given task, if you want to preserve the output in a named case, it’s one click. You no longer have to start with the New Case workflow, however it is recommended if that’s the direction you’re going from the start.

The Strings to YARA tool also gains a companion “Save to YARA Library” checkbox.  Check it, and the generated rule gets copied directly into the project’s yara_rules/ directory alongside being saved to the case. This will automatically make the rule available when you run fileanalyzer on subsequent files.  It’s a small workflow improvement, but one that eliminates a manual copy step I was taking every time anyway. I also added a quick formatter so the special character most often in need of escaping “\” gets handled automatically when the rule is generated.

A Note on malhash

malhash is retired in 3.2.  If you’ve been using it in scripts or workflows, tiquery is its direct replacement — it does everything malhash did and then some.  This is a breaking change in the sense that the binary is gone, but functionally tiquery is a superset, not a lateral move.

malhash served its purpose well.  RIP. tiquery is where that purpose lives now.

Get It

MalChela 3.2 is available now on GitHub.  The full release notes are in the repo. 

Thanks to xorhex for the nudge.  Sometimes the best features start with someone saying “have you thought about…”