Rust – Page 3 – Baker Street Forensics

MalChela Updates: New Features and Enhancements

DFIR, Forensics, hashing, Malware, Rust, SIgma, Triage, yara

It’s been just over a week since MalChela was initially released and already here have been a number of updates.

mStrings

In the previous post, I walked through the new mStrings function. I think this is one of my favorites so far. It extracts strings from a file and uses Sigma rules defined in YAML against the strings to evaluate threats and align results to the MITRE ATT&CK framework.

For fun I pointed it at an old WannaCry sample . I had a proud papa moment at the positive network IOC detection.

Check for Updates

Next came a function to automatically check the GitHub repo for updates and encourage a git pull to grab the latest… because apparently I can’t stop myself and this project will just keep growing, as my sleep keeps dwindling. Personally I found it ironic that you have to update in order to get the update telling you that updates are available… but it will work for all future updates as they come. So go ahead and update why don’t you.

*Screenshot of MalChela indicating an update is available via git.*

New File Analyzer module

Most recently a File Analyzer module has been added. Give it the path to your suspect file and it will return back:

SHA-256 Hash
Entropy (<7.5=high)
A RegEx detection for packing (mileage may vary)
PE Header info if it’s a PE
File Metadata
Yara Matches (any rules in yara_rules folder in workspace)
If there’s a positive match for the hash on VirusTotal (leverages the same key as previously in MalChela with the Virus Total / Malware Bazaar lookup)

Lastly, you’re given the option of whether or not you want to run strings on the file, or return to the main menu.

I really like the idea of using this as a possible first step in static analysis. Run this first and opt for strings. Things look interesting there, throw it into mStrings. Positive match on VirusTotal – use the malware hash lookup and get a more detailed analysis. Use the results from mStrings to craft a YARA rule and add it to your repo for future detections.

mStrings: A Practical Approach to Malware String Analysis

DFIR, Forensics, hashing, Malware, Rust, SIgma, Triage, yara

String analysis is a cornerstone of malware investigation, revealing embedded commands, URLs, and other artifacts that can expose a threat’s intent. mStrings, a Rust-based tool, simplifies this process by scanning files, extracting meaningful strings, and structuring results for efficient analysis.

At its core, mStrings is more than a simple string extraction tool. It integrates regex-based detection rules to identify key indicators, offering a refined approach to analyzing malware artifacts. In addition to console output it also presents data in a structured JSON format, allowing for seamless integration into other security workflows.

In addition to specialized string searching, mStrings detections associate results with MITRE ATT&CK. When malware indicators map to known MITRE ATT&CK techniques, analysts can quickly understand the intent and behavior of a threat. Instead of just seeing a suspicious string, they can recognize that it corresponds to credential dumping, command-and-control, or privilege escalation, enabling faster triage and response.

Optimized for Practical Investigation

Security professionals often need to cross-reference findings in a hex editor. mStrings accounts for this by capturing detailed string locations in hex, allowing for immediate context when reviewing suspicious files. This level of granularity is particularly valuable when analyzing packed or obfuscated malware, where offsets can provide crucial insights.

*mStrings showing hex location for identified string*

After the scan, reviewing the complete strings dump is just as easy with an option to open the results directly in VS Code.

*mStrings prompt to review saved strings*

Technology That Powers It

Built in Rust, mStrings leverages its robust ecosystem to enhance performance and reliability. Sigma-based detection rules allow for flexible and easily modifiable patterns, giving analysts control over what indicators to track. The tool’s structured approach ensures that results are not just extracted but meaningfully categorized for deeper analysis.

A Tool That Grows with You

mStrings is extensible, enabling you to customize detections. Not satisfied with the existing detection rules? You can easily write your own in Sigma. Future improvements will refine regex patterns, enhance Windows compatibility, and introduce new features to improve investigative workflows. Designed with usability in mind, mStrings serves as a practical companion for analysts who need clear, structured, and insightful data extraction.

MStrings is one of many malware analysis utilities included in MalChela. Download from Github and let me know what you think. If you’ve already installed Malchela, git pull will download the latest updates.

https://github.com/dwmetz/MalChela

Try this out for a workflow. Use Hash It (3) and give it the file path for a malware file. Use the hash from Hash It and check it against VirusTotal an Malware Bazaar with the Malware Hash Lookup (10). Then jump into mStrings (4), give it the same file path again, and start pulling out the interesting strings. Once you have what you think is a good number of indicators, run Strings to YARA (9) and generate a fully formatted YARA rule for use in any of your security tools.

MalChela – A YARA and Malware Analysis Toolkit written in Rust

DFIR, Forensics, hashing, Malware, Rust, yara

Saturday was for Python. Sunday was for Rust.

After my success with the Python + YARA + Hashing, I decided to take things to the next level. Over the past few years I’ve created a number of Python and PowerShell scripts related to YARA and Malware Analysis. What if I combined them into a single utility? While we’re at it, let’s rewrite them all from scratch in Rust. Boy, do I know how to let loose on the weekends.

MalChela

MalChela combines (currently 10) programs in one Rust workspace, that can be invoked using a launcher.

Features:

Combine YARA	Point it at a directory of YARA files and it will output one combined rule
Extract Samples	Point it at a directory of password protected malware files to extract all
Hash It	Point it to a file and get the MD5, SHA1 and SHA256 hash
MZMD5	Recurse a directory, for files with MZ header, create hash list
MZcount	Recurse a directory, uses YARA to count MZ, Zip, PDF, other
NSRL MD5 Lookup	Query a MD5 hash against NSRL
NSRL SHA1 Lookup	Query a SHA1hash against NSRL
Strings to YARA	Prompts for metadata and strings (text file) to create a YARA rule
Malware Hash Lookup	Query a hash value against VirusTotal & Malware Bazaar*
XMZMD5	Recurse a directory, for files without MZ, Zip or PDF header, create hash list

*The Malware Hash Lookup requires an api key for Virus Total and Malware Bazaar. If unidentified , MalChela will prompt you to create them the first time you run the malware lookup function.

What’s with the Name?

mal — malware

chela — “crab hand”

A chela on a crab is the scientific term for a claw or pincer. It’s a specialized appendage, typically found on the first pair of legs, used for grasping, defense, and manipulating things; just like these programs.

Sounds Awesome – How do I install it?

Install Rust – https://rustup.rs/

then

git clone https://github.com/dwmetz/MalChela.git
cd MalChela
cargo build

Run

cargo run -p malchela

Feedback

I’d love to get your feedback on this. Please download it and give it a try. I’m open to suggestions for adding additional capabilities.

https://github.com/dwmetz/MalChela