Skip to content

v4.4

Choose a tag to compare

View all tags
@dwmetz dwmetz released this 31 Oct 21:43
· 13 commits to main since this release
v4.4
292ebf4

MalChela v4.4

Three big themes in this release: Unpack, a new static unpacker that came straight out of conference feedback; ATT&CK v20 mapping across every tool and an interactive Enterprise matrix for every Analyze run; and the move to YARA-X, which removes the system YARA dependency entirely.

Highlights

🧩 Unpack (new tool)

Static packer detection and unpacking for PE, ELF, and Mach-O. Unpack identifies the packer, shows the evidence for the call, recovers the payload where that's possible without running anything, and feeds every recovered payload back through itself, so nested layers come out as a tree.

  • UPX, including the tampered headers Mirai-family malware uses to break upx -d (fixed on a working copy, with every changed byte recorded)
  • PyInstaller, plus a pure-Rust Python bytecode layer for CPython 3.7–3.14 that peels obfuscation wrappers (xz, zlib, gzip, LZMA, base64, and BlankOBF's rot13 + split + reversed pieces) and writes a strings report straight into mStrings
  • .NET / Costura embedded resources, NSIS, Inno Setup, fat (universal) Mach-O, overlays, and embedded executables
  • Built into Analyze and File Miner, so recovered payloads get the full tool stack automatically
  • Never executes or emulates the sample

🎯 MITRE ATT&CK, everywhere

  • ATT&CK v20. Stealth (TA0005) and Defense Impairment (TA0112) replace the retired Defense Evasion tactic, and revoked techniques are remapped (T1562.001 → T1685).
  • An interactive Enterprise matrix for Analyze. Each run rolls up every technique from mStrings, Unpack, and the other tools' flags into one matrix in the web interface. Tiles are shaded by how many files hit, and a detail card shows the evidence and matched strings. Each run also saves an ATT&CK Navigator layer (format 4.5).
  • Matrices for saved cases. Open the matrix from any case. It combines every Analyze run and every standalone tool report in the case, including cases saved before this release.
  • One click from a technique ID to its details. In mStrings results, clicking a technique ID opens the built-in MITRE Lookup. Cmd/Ctrl-click, or the ↗, still opens attack.mitre.org.
  • New rules: Microsoft Defender tampering (T1685), webhook exfiltration to Discord, Telegram, Slack, and Microsoft Teams (T1567.004), and IoT default-credential lists (T1110.001).
  • Private IPs are indicators, not C2. RFC 1918 and link-local addresses are still listed as IOCs, but no longer claim T1071.001.

🦀 YARA-X migration

Every MalChela tool now runs YARA rules on YARA-X, VirusTotal's Rust rewrite of YARA, through the new yara-backend crate.

  • No system YARA library. The yara and libyara-dev packages are gone, along with the YARA_LIBRARY_PATH and BINDGEN_EXTRA_CLANG_ARGS exports, bindgen, and OpenSSL (HTTPS now uses rustls). The build needs only a C compiler and make.
  • Simpler installs. On Linux, sudo apt install build-essential pkg-config; on macOS, xcode-select --install.
  • A step toward native Windows. With libyara gone, the main blocker is out of the way. WSL2 remains the supported path while native builds are tested.
  • YARA-X is pinned at 1.21, past the vulnerability affecting releases up to 1.18.0.

A big thank-you to Daniel Iwugo (@elementmerc) for the yara-backend work: moving File Analyzer onto it, and closing the gaps between it and libyara's behavior (#4, #5).

New

  • YARA Scan. A native rule scanner on the embedded YARA-X engine whose flags and output follow VirusTotal's yr scan. It was tested side by side with yr 1.21 on 5,893 signature-base rules, with identical results. It saves reports to a case and has a simplified web panel and an MCP tool. Options it doesn't cover (-C, -x, and a few others) are refused with a pointer to yr.
  • IP reputation. Threat Intel Query looks up IP addresses on VirusTotal, AlienVault OTX, and GreyNoise (new). There's a new IP tab, defanged input is accepted, and each source's verdict is shown rather than just found/not found. Analyze enriches the IPs it finds the same way, with a cap and skipped in offline mode.
  • IP lists in mStrings. Ten or more addresses stored together (an anti-analysis blocklist or a C2 pool) are reported as one list rather than as dozens of C2 indicators. Public DNS resolvers get their own section.
  • Encoded string tables. When malware keeps its payload as hundreds of encoded strings (AMOS stores its whole AppleScript as about 1,900 of them), mStrings reports one "Encoded string table" finding (T1027.013) instead of drowning in per-string matches.
  • Analyze summaries follow Lenny Zeltser's Malware Analysis Report template: Sample Snapshot, Component Inventory, Capabilities, tiered Indicators of Compromise, Analysis Details, and Analysis Environment.
  • The Zeltser template is built into the MCP plugin. New report_template and save_report tools give an AI assistant the template (CC BY 4.0, bundled with attribution) and save the finished report to the case.

Improvements

  • The API Keys panel adds GreyNoise, and At a Glance counts all 21 MalChela tools to match About.
  • About lists every tool, including Unpack, YARA Scan, MITRE Lookup, and dpp Extract.
  • mzhash, xmzhash, mzcount, and mismatchminer moved to YARA-X.
  • Python 3.14 bytecode support.

Docs

  • New pages for Unpack and YARA Scan. Installation is rewritten for the YARA-X build.

Upgrading

Pull, then rebuild with ./release.sh. If you exported YARA_LIBRARY_PATH or BINDGEN_EXTRA_CLANG_ARGS for an earlier MalChela build, you can remove them from your shell profile. The old YARA packages can stay installed; nothing uses them now.

Assets 3
Loading