Skip to content

v4.2

Latest
Latest

Choose a tag to compare

View all tags
@dwmetz dwmetz released this 20 Jul 20:39
v4.2
0b6a764

MalChela v4.2

Added

Mac app bundle support ("Mac Stack")

Four tools now understand .app bundles directly, not just raw binaries — point macho_info, codesign_check, mstrings, or plist_analyzer at a bundle and they auto-resolve the main executable (via CFBundleExecutable, falling back to the sole binary in Contents/MacOS/) where needed:

  • macho_info — architecture, PIE/ASLR, __PAGEZERO, linked libraries, per-section entropy; flags deprecated/EOL crypto libraries, RPATH entries (dylib hijacking), and the CoreFoundation+SystemConfiguration+Security dylib triad common in C2 implants.
  • codesign_check — signature status (Developer-signed / Ad-hoc / Unsigned), Bundle ID, Team ID, entitlements, get-task-allow (debug build indicator), and Team ID mismatches between a bundle's signer and its main executable's signer (a supply-chain / hijack indicator).
  • plist_analyzer — flags LSUIElement/NSUIElement (hidden background agent), NSAllowsArbitraryLoads (ATS disabled), custom CFBundleURLTypes registrations, missing CFBundleSignature, and missing/extra binaries inside Contents/MacOS/.
  • mstrings — now scans Mach-O binaries and bundles directly, with the same bundle-to-executable auto-resolution.

More Mac-specific detections are in the pipeline for upcoming releases.

Analyze — one-click auto-triage

Point Analyze at a file, folder, or .app bundle and it classifies everything with FileMiner and automatically dispatches every tool FileMiner suggests per file — no more manually reading suggestions and running each tool by hand. Available in both the PWA and as a new analyze tool in the MCP server, so Claude can run the same triage workflow directly.

  • Save to Case — matches the same checkbox-and-dropdown pattern every other tool panel uses; case-saving is opt-in, and the MCP's version requires an active case (set_case) first, consistent with how the rest of the MCP works.
  • Concise Output (on by default) — renders the rollup report inline instead of the full expanded per-tool output.

MalChela Summary rollup report

Every Analyze run produces a single malchela_summary_.md, saved alongside the individual tool reports. It leads with a Triage Summary banner covering:

  • File counts, with automatic grouping of duplicate content (files sharing a SHA256 under different names — common with carved or exported artifacts — get one write-up instead of repeats)
  • Flagged-malicious verdicts (VirusTotal, cross-referenced from both FileAnalyzer and tiquery so Mach-O samples get the same coverage as PE)
  • Malware family/tag names pulled from tiquery's multi-source lookups
  • MITRE ATT&CK findings from mstrings, totaled and broken down by tactic
  • Filesystem and network IOCs surfaced by mstrings
  • Structural flags/indicators from macho_info, plist_analyzer, and codesign_check

Per-file sections embed each tool's actual formatted report — real tables and headers, not raw console output — so the rollup reads cleanly both in the PWA and as a standalone document.

Fixed

  • case.yaml (the per-case manifest the case browser reads) now gets populated for CLI- and MCP-driven tool runs, not just runs started from the web UI.
Assets 3
Loading