Malware Analysis – Baker Street Forensics

Streamline Malware Hash Search with FOSSOR

DFIR, Forensics, hashing, Malware, Python

We’ve all encountered this scenario: you’re reading a threat report from CISA or Microsoft and come across hashes related to a malware infection. You start copying these hashes and head to one of your favorite virus repositories to check if there’s a source available for download so you can analyze the malware yourself. Unfortunately, you don’t find a match. So, you move on to another site and repeat the process. This can be time-consuming and prone to errors.

FOSSOR (Federated Open-Source Sample Search & Object Retriever) is a script designed to help you search for malware hashes across multiple threat intelligence sources. Simply run FOSSOR and provide it with a single hash or a text file of hashes (.txt or .csv). It will instantly display which sources have information about the hash, and you can even download samples if needed.

Setup

FOSSOR loads API keys from text files in the same directory as the script. Create one file per source containing only the key:

Source	Key file	Where to get a key
MalwareBazaar	`mb-api.txt`	abuse.ch Auth Portal
VirusTotal	`vt-api.txt`	VirusTotal API
AlienVault OTX	`otx-api.txt`	OTX Account Settings

Sources with missing key files are automatically skipped. You only need the sources you have access to.

			
fossor/
  fossor.py
  mb-api.txt      # your MalwareBazaar key
  vt-api.txt      # your VirusTotal key
  otx-api.txt     # your OTX key
  samples/        # created automatically by --download

		

Usage

Look up hashes from a file

python3 fossor.py hashes.txt

The input file should have one hash per line. Lines starting with # are treated as comments and ignored. Works with .txt, .csv, or any text file — BOM and stray whitespace are handled automatically.

Look up a single hash

			
python3 fossor.py d0a2035c0431796c138a26d1c9a75142b613c5417dc96a9200723870d0b3a687

Export results to CSV

python3 fossor.py hashes.txt --csv results.csv

Download available samples

python3 fossor.py hashes.txt --download

Downloads are saved to ./samples/ as password-protected zips. The password is always infected.

Warning: Downloaded samples are live malware. Handle with appropriate caution — use a VM or isolated analysis environment. Consider excluding the samples/ directory from antivirus real-time scanning and Spotlight indexing.

Disable specific sources

			
python3 fossor.py hashes.txt --no-vt           # skip VirusTotal
python3 fossor.py hashes.txt --no-mb --no-otx  # only query VirusTotal

Combine options

python3 fossor.py hashes.txt --csv results.csv --download --no-vt

Example Output

			
[*] MalwareBazaar: key loaded
[*] VirusTotal: key loaded
[*] OTX: key loaded
[*] Querying 9 hashes (SHA256) across: MalwareBazaar, VirusTotal, OTX
[1/9] 9d867ddb54f37592fa0b... (SHA256)
  MalwareBazaar:    NOT FOUND
  VirusTotal:       HIT - trojan.fzdtv/fkmsvcr | ZIP | 22/76
  OTX:              HIT - Infostealers without borders... | FileHash-SHA256 | 3 pulses
[2/9] d0a2035c0431796c138a... (SHA256)
  MalwareBazaar:    HIT - RedLineStealer | exe
  VirusTotal:       HIT - trojan.laplasclipper/steal | Win32 EXE | 40/75
  OTX:              HIT - InfoStealers - Jan 2025 | FileHash-SHA256 | 1 pulses
============================================================
Summary: 9 hashes queried across 3 sources
  MalwareBazaar:    1/9 found
  VirusTotal:       6/9 found
  OTX:              5/9 found
  Unique hashes with at least one hit: 7/9
Results Matrix:
  Hash               Malwar     VT    OTX
  ------------------ ------ ------ ------
  9d867ddb54f37592fa      -    HIT    HIT
  08a1f4566657a07688      -    HIT      -
  5970d564b5b2f5a472      -    HIT    HIT
  d0a2035c0431796c13    HIT    HIT    HIT
  59855f0ec42546ce2b      -      -      -
  a5b19195f61925ede7      -    HIT    HIT
  e7237b233fc6fda614      -    HIT      -
  59347a8b1841d33afd      -      -    HIT
  e965eb96df16eac926      -      -      -
============================================================

		

Rate Limits

Source	Limit	FOSSOR default
MalwareBazaar	None documented	No delay
VirusTotal (free)	4 requests/min	15s between requests
AlienVault OTX	10,000 requests/hr	No delay

Download

You can download FOSSOR for free on GitHub: https://github.com/dwmetz/FOSSOR/

MalChela 2.2 “REMnux” Release

DFIR, Forensics, Malware, Rust

MalChela’s 2.2 update is packed with practical and platform-friendly improvements. It includes native support for REMnux, better tool settings, and deeper integrations with analysis tools like YARA-X, Tshark, Volatility3, and the newly improved fileanalyzer module.

🦀 REMnux Edition: Built-In Support, Zero Tweaks

When the GUI loads a REMnux-specific tools.yaml profile, it enters REMnux mode.

Screenshot of yaml configuration applying REMnux mode

Native binaries and Python scripts like capa, oledump.py, olevba, and FLOSS are loaded into the MalChela tools menu, allowing you to mix and match operations with the embedded MalChela utilities and the full REMnux tool stack. No manual configuration needed—just launch and go. MalChela currently supports the following REMnux programs right out of the box:

Tool Name	Description
binwalk	Firmware analysis and extraction tool
capa	Identifies capabilities in executable files
radare2	Advanced reverse engineering framework
Volatility 3	Memory forensics framework for RAM analysis
exiftool	Extracts metadata from images, documents, and more
TShark	Terminal-based network packet analyzer (Wireshark CLI)
mraptor	Detects malicious macros in Office documents
oledump	Parses OLE files and embedded streams
oleid	Identifies features in OLE files that may indicate threats
olevba	Extracts and analyzes VBA macros from Office files
rtfobj	Extracts embedded objects from RTF documents
zipdump	Inspects contents of ZIP files, including suspicious payloads
pdf-parser	Analyzes structure and contents of suspicious PDFs
FLOSS	Reveals obfuscated and decoded strings in binaries
clamscan	On-demand virus scanner using ClamAV engine
strings	Extracts printable strings from binary files
YARA-X	Next-generation high-performance YARA rule scanner

If you only need a subset of tools you can easily save and restore that a custom profile.

TShark Panel with Built-In Reference

Tshark and the integrated field reference

A new TShark integration exposes features including:

A filter builder panel
Commonly used fields reference
Tooltip hints for each example (e.g., `ip.addr == 192.168.1.1` shows “Any traffic to or from 192.168.1.1”)
One-click copy support

This helps analysts build and understand filters quickly—even if TShark isn’t something they use every day. Using the syntax builder in MalChela you can use the exact commands directly in Tshark or Wireshark.

YARA-X Support (Install Guide Included)

Support for YARA-X (via the `yr` binary) is now built in. YARA-X is not bundled with REMnux by default, but install instructions are included in the User Guide for both macOS and Linux users.

Once installed, MalChela allows for rule-based scanning from the GUI,and with YARA-X, it’s faster than ever.

fileanalyzer: Fuzzy Hashing, PE Metadata, and More

MalChela’s fileanalyzer tool has also been updated to include:

Fuzzy hashing support via `ssdeep`
BLAKE3 hashing for fast, secure fingerprints
Expanded PE analysis, including:
Import and Export Table parsing (list of imported and exported functions)
Compilation Timestamp (for detection of suspicious or forged build times)
Section Characteristics (flags like IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, etc., for detecting anomalous sections)

These improvements provide deeper insight into executable structure, helping analysts detect anomalies such as packers, suspicious timestamps, or unexpected imports/exports. Useful for everything from sample triage to correlation, fileanalyzer now digs deeper—without slowing down.

Memory Forensics Gets a Boost: Volatility 3 Now Supported

With the 2.2 release, MalChela introduces support for Volatility 3, the modern Python-based memory forensics framework. Whether you’re running MalChela in REMnux or on a customized macOS or Linux setup, you can now access the full power of Volatility directly from the MalChela GUI.

There’s an intuitive plugin selector that dynamically adjusts available arguments based on your chosen plugin,. You can search, sort, and browse available plugins, and even toggle output options like –dump-dir with ease.

Like Tshark, there is an added plugin reference panel with searchable descriptions and argument overviews — a real time-saver when navigating Volatility’s deep and often complex toolset.

Smarter Tool Configuration via YAML

The tool configuration system continues to evolve:

Tools now declare their input type (file, folder, or hash)
The GUI dynamically adjusts the interface to match
Alternate profiles (like REMnux setups) can be managed simply by swapping `tools.yaml` files via the GUI
Easily backup or restore your custom setups
Restore the default toolset to get back to basics

This structure helps keep things clean—whether you’re testing, teaching, or deploying in a lab environment.

Embedded Documentation Access

The GUI now includes a link to the full MalChela User Guide in PDF. You can also access the documentation online.

From tool usage and CLI flags to configuration tips and install steps, it’s all just a click away—especially useful in offline environments or when onboarding new analysts. I’ll be honest, this is likely the most comprehensive user guide I’ve ever written.

Whether you’re reviewing binaries, building hash sets, or exploring network captures—MalChela 2.2 is designed bring together the tools you need, and make it easier to interoperate between them.

The new REMnux mode makes it even easier to get up and running with dozens of third party integrations.

Have an idea for a feature or application you’d like to see supported — reach out to me.

GitHub: REMnux Release

MalChela User Guide: Online, PDF, Web

Shop: T-shirts, hats, stickers, and more

MalChela v2.1 Released: Smoother Workflows, Easier Tool Integration

DFIR, Forensics, Malware, Rust

🧰 A Toolkit That Grows With You

Version 2.1 of MalChela, the modular digital forensics and malware analysis launcher, is now available. This release focuses on flexibility and simplicity — especially when integrating third-party tools and refining workflows between CLI and GUI.

Whether you’re testing suspicious files, generating YARA rules, or examining malware indicators from different sources, the updated interface helps you move fluidly from one tool to another — without losing your place or rewriting commands.

🔄 Run, Re-run, Refine

One of the most helpful improvements in 2.1 is the ability to quickly rerun tools with updated arguments. There’s no need to backtrack or manually rebuild command lines. Just update the Arguments field in the GUI, click Run, and MalChela will handle the rest.

If you’re pivoting between tools like mstrings, pdf-parser, or capa, the consistent interface lets you switch input, adjust flags, and review results in one console — no clutter, no confusion.

🔌 Integration Made Easy

You can now seamlessly add external tools — including Python scripts, native binaries, or custom Rust programs — using just the tools.yaml configuration file. Each tool can define:

Input type (file, folder, or hash)
Command structure
Where input should appear in the argument list
Whether it’s a script, binary, or cargo-built tool

The GUI reads these definitions and builds a dynamic interface to support them, removing the guesswork of launching external programs.

💾 One Report to Rule Them All

In past versions, you might have seen multiple output files for a single run — especially when running scripts that already saved their own logs. That’s no longer the case.

With 2.1, all tools now produce a single unified report when run through the GUI. Even scripts that don’t natively generate output will have their results captured and saved by MalChela, giving you clean, consistent documentation for every tool.

🐚 CLI Power, GUI Convenience

MalChela still supports CLI-based workflows (cargo run -p toolname) and a menu-driven terminal launcher. But the GUI now offers a refined experience for analysts who want more visibility, easier input selection, and better organization of results — without losing the precision of command-line control.

🚀 Try It Out

MalChela is open-source and free to use. You can:

Download the latest release
Add your own tools using the updated tools.yaml
Review the User Guide for setup tips and sample workflows

🎥 A Video Tour

If you haven’t seen it yet, be sure to check out the YouTube video where I walk through some of the different functions in MalChela in the new GUI, stepping through basic static analysis to yara rule writing – all in minutes.

🙏 Thank You

A huge thank you to the community of forensic analysts and developers who continue to test, refine, and inspire this project. If you have feedback, feature ideas, or tools you’d like to see integrated — reach out, submit a PR, or just let me know what’s working.

Mining for Mismatches: Detecting Executables Disguised as Image Files

DFIR, hashing, Malware, Rust, yara

Malware authors often use file masquerading—disguising malicious executables as seemingly harmless files—to bypass both user scrutiny and automated defenses. A classic example is an executable file with an image extension, such as `.png`, that actually contains a Windows PE binary. To help address this challenge, the Mismatch Miner utility, written in Rust and part of the MalChela malware analysis toolkit, introduces a practical approach for uncovering these deceptive files using YARA rules.

Why File Masquerading Matters

File extension spoofing remains a simple yet effective evasion tactic. Users and some security tools may trust files based on their extensions, ignoring the underlying content. Attackers exploit this by renaming executables with extensions like `.jpg` or `.png`, hoping to slip past defenses. While this technique is not new, it continues to be relevant due to its effectiveness and the limitations of extension-based filtering.

That said, this method should be seen as one component of a broader detection strategy. While it is effective for catching executables disguised as images or documents, it does not address more sophisticated evasion tactics, such as fileless malware or executables embedded within other file formats. Additionally, some legitimate software may use unconventional file extensions, so results should be reviewed with context in mind.

Mismatch Miner: Approach and Implementation

Mismatch Miner is designed to scan a directory for files with extensions that are commonly abused for masquerading, including popular image formats. For each candidate file, it leverages YARA—a widely used pattern-matching tool in malware analysis—to check for the presence of the “MZ” header, which marks the start of Windows executable files. If a file’s extension suggests it is an image, but its header indicates it is an executable, the tool flags the file and reports its name, full path, and SHA256 hash, to support further investigation.

Mismatch Miner offers a practical solution for identifying a common malware evasion technique: executables disguised as benign files. By combining Rust’s performance with YARA’s pattern-matching, it provides security analysts with a reliable tool for uncovering hidden threats. While not a panacea, header-based mismatch detection is a useful addition to any malware analysis workflow, helping to close a gap that attackers continue to exploit.

Mismatch Miner is bundled with MalChela, the YARA & Malware Analysis toolkit. If you’ve already installed it, a ‘git pull’ from your workspace directory should get you the new feature.

https://github.com/dwmetz/MalChela