Saturday was for Python. Sunday was for Rust.
After my success with the Python + YARA + Hashing, I decided to take things to the next level. Over the past few years I’ve created a number of Python and PowerShell scripts related to YARA and Malware Analysis. What if I combined them into a single utility? While we’re at it, let’s rewrite them all from scratch in Rust. Boy, do I know how to let loose on the weekends.
MalChela
MalChela combines (currently 10) programs in one Rust workspace, that can be invoked using a launcher.
Features:
| Combine YARA | Point it at a directory of YARA files and it will output one combined rule |
| Extract Samples | Point it at a directory of password protected malware files to extract all |
| Hash It | Point it to a file and get the MD5, SHA1 and SHA256 hash |
| MZMD5 | Recurse a directory, for files with MZ header, create hash list |
| MZcount | Recurse a directory, uses YARA to count MZ, Zip, PDF, other |
| NSRL MD5 Lookup | Query a MD5 hash against NSRL |
| NSRL SHA1 Lookup | Query a SHA1hash against NSRL |
| Strings to YARA | Prompts for metadata and strings (text file) to create a YARA rule |
| Malware Hash Lookup | Query a hash value against VirusTotal & Malware Bazaar* |
| XMZMD5 | Recurse a directory, for files without MZ, Zip or PDF header, create hash list |
*The Malware Hash Lookup requires an api key for Virus Total and Malware Bazaar. If unidentified , MalChela will prompt you to create them the first time you run the malware lookup function.
What’s with the Name?
mal — malware
chela — “crab hand”
A chela on a crab is the scientific term for a claw or pincer. It’s a specialized appendage, typically found on the first pair of legs, used for grasping, defense, and manipulating things; just like these programs.
Sounds Awesome – How do I install it?
Install Rust – https://rustup.rs/
then
git clone https://github.com/dwmetz/MalChela.git
cd MalChela
cargo buildRun
cargo run -p malchelaFeedback
I’d love to get your feedback on this. Please download it and give it a try. I’m open to suggestions for adding additional capabilities.
Baker Street Forensics 