There’s a moment every analyst knows — the one where an unknown file lands on your desk and the clock starts ticking. You need answers, and you need them fast. MalChela was built for exactly that moment.
Today I’m excited to announce the MalChela Video Series on YouTube — a growing collection of tutorial episodes walking through real malware analysis workflows using MalChela, the open-source Rust-based toolkit I’ve been building for the DFIR community. Whether you’re new to the tool or already running it in your lab, there’s something here for you.
Four episodes are available right now in the playlist.
What’s in the Playlist
Ep0 | Installation & First Run
Every case starts somewhere. Episode 0 is your onboarding — installing MalChela, walking through its dependencies, and getting oriented with both the CLI and GUI modes. If you’ve been curious about the tool but weren’t sure where to start, this is the episode to bookmark.
Ep1 | First Contact: Hash, Inspect, Identify
You’ve just been handed a suspicious file. What do you do first?
This episode covers the first three tools in a malware triage workflow — the exact sequence I reach for every time I encounter an unknown file:
- hashit — generate MD5, SHA1, and SHA256 hashes to protect chain of custody and enable deduplication
- fileanalyzer — static inspection: entropy analysis, PE header fields, compile timestamps, and import tables
- malhash — simultaneous lookup against VirusTotal and MalwareBazaar to identify known malware families
By the end of this episode, you’ll take an unknown file from zero to confirmed malware family identification in under five minutes — no sandboxing required.
Ep2 | From Strings to Signatures
Continuing from Episode 1, we go deeper into the confirmed RedLine info-stealer sample using mStrings — MalChela’s string extraction engine. Unlike the traditional strings utility, mStrings runs every extracted string through a detection ruleset and MITRE ATT&CK mapping layer simultaneously, turning raw output into actionable intelligence.
We walk through 62 detections, including PDB path artifacts, hard-coded dropper filenames, WMI queries, credential harvesting patterns, anti-debug checks, and a code injection setup. We then feed the extracted IOCs into Strings2YARA to auto-generate a structured YARA rule — and confirm it fires against the sample using File Analyzer.
By the end, you’ll be reading a malware file not as a pile of strings, but as a window into the attacker’s tradecraft.
Ep3 | REMnux Mode & Custom Tools
MalChela doesn’t work in isolation. Episode 3 covers how to extend the toolkit through the tools.yaml config file and how enabling REMnux mode surfaces an entire distro’s worth of malware analysis utilities directly within MalChela’s interface.
We also explore three built-in integrations: Volatility 3 with a dynamic plugin builder, T-Shark with a searchable reference, and YARA-X — a faster, Rust-native rewrite of YARA.
What’s Coming
The series is ongoing. Future episodes will push further into advanced workflows — think directory-scale triage, corpus management, and the AI-assisted analysis capabilities introduced in MalChela’s MCP integration. Stay subscribed and you won’t miss them.
Get Involved
If MalChela is useful in your work, the best thing you can do is help spread the word:
- 📺 Subscribe to the YouTube channel — Subscribe to the channel and save the playlist so you don’t miss new episodes as they land.
- 📖 Follow Baker Street Forensics — Writeups, major releases, and workflow deep dives live here.
- 💬 Share and comment — If an episode clicks for you, pass it along to a colleague or drop a comment on the video. That feedback genuinely shapes what comes next.
The game is afoot. Let’s get to work.
MalChela is open-source and freely available. Find the project on GitHub.
Baker Street Forensics 