Rust – Page 4 – Baker Street Forensics

Saturday was for Python. Sunday was for Rust.

After my success with the Python + YARA + Hashing, I decided to take things to the next level. Over the past few years I’ve created a number of Python and PowerShell scripts related to YARA and Malware Analysis. What if I combined them into a single utility? While we’re at it, let’s rewrite them all from scratch in Rust. Boy, do I know how to let loose on the weekends.

MalChela

MalChela combines (currently 10) programs in one Rust workspace, that can be invoked using a launcher.

Features:

Combine YARA	Point it at a directory of YARA files and it will output one combined rule
Extract Samples	Point it at a directory of password protected malware files to extract all
Hash It	Point it to a file and get the MD5, SHA1 and SHA256 hash
MZMD5	Recurse a directory, for files with MZ header, create hash list
MZcount	Recurse a directory, uses YARA to count MZ, Zip, PDF, other
NSRL MD5 Lookup	Query a MD5 hash against NSRL
NSRL SHA1 Lookup	Query a SHA1hash against NSRL
Strings to YARA	Prompts for metadata and strings (text file) to create a YARA rule
Malware Hash Lookup	Query a hash value against VirusTotal & Malware Bazaar*
XMZMD5	Recurse a directory, for files without MZ, Zip or PDF header, create hash list

*The Malware Hash Lookup requires an api key for Virus Total and Malware Bazaar. If unidentified , MalChela will prompt you to create them the first time you run the malware lookup function.

What’s with the Name?

mal — malware

chela — “crab hand”

A chela on a crab is the scientific term for a claw or pincer. It’s a specialized appendage, typically found on the first pair of legs, used for grasping, defense, and manipulating things; just like these programs.

Sounds Awesome – How do I install it?

Install Rust – https://rustup.rs/

then

git clone https://github.com/dwmetz/MalChela.git
cd MalChela
cargo build

Run

cargo run -p malchela

Feedback

I’d love to get your feedback on this. Please download it and give it a try. I’m open to suggestions for adding additional capabilities.

https://github.com/dwmetz/MalChela

Tag: Rust

MalChela – A YARA and Malware Analysis Toolkit written in Rust