Skip to content

InCyter v0.0.8

Choose a tag to compare

View all tags
@FadyAzzi FadyAzzi released this 15 Oct 12:56
v0.0.8
16cc165
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

InCyter v0.0.8 - Major update to Malware Analysis

Malware Analysis now holds everything you need to examine a suspicious file, log or app: File Analysis, Event Logs, Store Apps, Encrypted Files, Fuzzy Hash and YARA Scanner.

The first time you open this version, a What's New window shows each headline with a screenshot of where to click. You can reopen it any time from Settings > About.

Event Logs (new)

Drop Windows event logs (.evtx), or click Analyse this PC. If you approve the administrator prompt, the Security log is included too.

  • What needs attention, most serious first - password guessing and spraying (including spraying that succeeded), logons shaped like pass-the-hash, one account reaching many computers, failed and outgoing Remote Desktop connections, records deleted from the middle of a log
  • Remote-access tools - AnyDesk, ScreenConnect, Atera, TeamViewer, RustDesk, ngrok and 19 more
  • Abused drivers - 56 driver names known to be used to switch off security software, plus 24 known-vulnerable driver builds
  • Sign-ins and sessions - who logged on, from where and for how long, in your local time (UTC with one click)
  • Findings start folded, with Show / Find filters right above them. Exclude what you expect to see, and export findings to CSV or JSON
  • Event Explorer - every record, searchable, with filters, a date calendar and presets. Click any account or address on the page to open everything about it

Store Apps (new)

Some apps only come from a store and can't be downloaded as a file. Paste an App Store, Microsoft Store or Google Play link, here or in the Home scan bar. InCyter shows:

  • who publishes the app, how long it has been listed, its ratings and when it was last updated
  • for Microsoft Store apps, what the app is allowed to do
  • look-alike apps that use a famous name but come from a different publisher

This checks the store listing, not the app's code. To check the code, InCyter needs the app file.

Mac files (new)

Drop a .dmg, .pkg, Mac program, configuration profile, launch agent or AppleScript in File Analysis.

  • Signatures are verified, not just read: the certificate chain is checked against Apple's root certificates, and the signature must match this exact code. A signature copied from another app fails
  • Check with Apple asks Apple's own services whether the app is notarised and whether its certificate has been revoked. It sends only the code hash, and only when you click it
  • Profiles show what they would change, such as a browser extension forced on you or Gatekeeper switched off
  • Every Mac detection was reviewed against Apple's documentation and real installers, so ordinary installers (Docker, Office, MacTeX) are no longer flagged as risky

Android and iPhone apps (new)

Drop an .apk (or a split .xapk / .apks bundle) or an .ipa in File Analysis.

  • permissions explained in plain words
  • the permission patterns used by banking trojans and spyware
  • who signed the app, and debug builds
  • for iPhone apps, how the app is distributed (App Store, enterprise or ad hoc)

Help on every page (new)

Press Help on any page for a step-by-step guide. Each step is collapsed - click one for a few plain lines and a picture of where to click.

  • Help opens at the tab or lens you're on (Help on Email > IOCs opens the IOCs step)
  • The guide stays open beside the page while you work
  • All 47 pages and tabs are covered, including some that had no help before

Also new

  • OneNote notebooks (.one) - lists the files hidden inside and flags scripts and programs behind a "double-click to view" picture
  • Faster on big files - large disk images and archives are read in parallel, and files on cloud drives are copied locally first. A 700 MB disk image went from 35 seconds to 6
  • Home scan bar - drop a file on it or click Browse, and it opens in the right tool. Typing an IP, domain, URL, hash or CVE works as before
  • Domain Tools > DMARC Reports - reads the reports that mail receivers send you, and tells you whether you're ready to enforce
  • IOC export as STIX 2.1 or a MISP event
  • Passive DNS takes an IP address - it lists the domains seen on it
  • Popups open in place instead of flashing in the corner first, and tab bars wrap on narrow windows
  • The navigation bar opens after you rest on it for a second, so you can click an icon without it sliding open
  • Settings > Input History: remove single entries, and Clear asks before deleting

Fixed

  • The progress bar on .dmg and .pkg files could get stuck at 1% or time out
  • A memory dump (.dmp) could open on an empty Document lens instead of listing the programs inside it
  • After opening a PDF, its blank pane stayed on screen under every other lens
  • Older CVEs scored only with CVSS v2 showed no severity in Software Search and CVE Lookup
  • Software Search matched words separately, mixing in unrelated CVEs - several words are now searched as a phrase
  • Email IOCs listed the Message-ID as an email address
  • IOC Extract reported Office template links (schemas.microsoft.com) as indicators
  • YARA Scanner counted rule files in subfolders that a scan never reads
  • The QR Code tab's hint text was cut off
  • Outlook's address-book downloads were flagged as an unusual site
  • Password-spraying counts stopped at 40
  • Popups on a second monitor jumped to the main screen
  • DMARC: "DKIM for Microsoft 365" contradicted itself behind a mail gateway

Installation: Run InCyterInstaller.exe - no Python required. Requires Windows 10/11 x64.

Assets 4
Loading