{ "markdown": "
\n \n

\n

\n MalChela v4.3.1\n

\n

\n A YARA & Malware Analysis Toolkit written in Rust.\n

\n

\n\n Check out the new [MalChela instructional series](https://www.youtube.com/playlist?list=PL__KsCEzV6Ae5jA-YObTmvZEKuu-rkON6) on YouTube \n \n

\n

\n
\n \n \n \n \n \n \n \n \n \n
PWA ViewCLI View
\n
\n\n

About:

\n\n> **mal** — malware \n> **chela** — \"crab hand\" \n> A chela on a crab is the scientific term for a claw or pincer. It's a specialized appendage, typically found on the first pair of legs, used for grasping, defense, and manipulating things — just like these programs.\n\n---\n\n

Features:

\n\n| Program | Function |\n|---------------------|----------|\n| Analyze | Auto-triages a file, folder, or `.app` bundle: classifies with File Miner, dispatches every tool it suggests, and produces a combined MalChela Summary rollup report |\n| Combine YARA | Combines all `.yara`/`.yar` files in a directory into a single rule file |\n| Extract Samples | Recursively extracts password-protected malware archives (ZIP/RAR) using common passwords |\n| File Analyzer | Analyzes a file for hashes, entropy, PE structure, fuzzy hashes, YARA matches, NSRL lookup, and VirusTotal status |\n| File Miner | Scans a folder for file type mismatches and metadata |\n| Hash It | Generates MD5, SHA1, and SHA256 hashes for a single file |\n| Hash Check | Checks if a given hash exists in a provided hash set file |\n| Threat Intel Query | Multi-source hash **and URL** lookup. Hash sources: VirusTotal, MalwareBazaar, OTX, Hybrid Analysis, FileScan.IO, Malshare, MetaDefender, ObjectiveSee. URL sources: VirusTotal, urlscan.io, Google Safe Browsing. GUI adds file-to-hash and QR code decode → URL lookup. |\n| mStrings | Extracts strings from a file — including Mach-O binaries and `.app` bundles — applies regex and Sigma rules, maps to MITRE ATT&CK, identifies filesystem/network IOCs, and includes built-in MITRE Technique lookup |\n| mzhash | Recursively hashes files with MZ headers using MD5 — ideal for gold build or known-bad corpus generation |\n| mzcount | Recursively counts files by format (MZ, ZIP, PDF, etc.) using header/YARA detection |\n| nsrlquery | Queries an MD5 hash against the NSRL database to determine if it's known-good |\n| strings_to_yara | Prompts for metadata and a string list to generate a YARA rule |\n| xmzhash | Recursively hashes files that are *not* MZ, ZIP, or PDF — ideal for non-Windows malware corpus |\n\n**Mac Analysis** *(v4.2+)*\n\n| Program | Function |\n|------------------|----------|\n| Code Sign Check | Inspects macOS code signing: Developer-signed vs. ad-hoc vs. unsigned, Team ID, Bundle ID, entitlements, and `get-task-allow` flag |\n| dpp Extract | Unwraps a `.dmg` or `.pkg` (UDIF → HFS+/APFS → XAR → PBZX/CPIO) to reach the real payload files inside |\n| Mach-O Info | Parses Mach-O binaries: architecture, linked libraries, section entropy, symbol status, RPATH entries, and deprecated crypto library detection |\n| mStrings | Extracts strings, IOCs, and MITRE ATT&CK matches from Mach-O binaries and `.app` bundles |\n| Plist Analyzer | Parses `.plist` files and `.app` bundle `Info.plist` for malware indicators: hidden background agent, ATS disabled, custom URL schemes, env injection |\n\nCode Sign Check, Mach-O Info, mStrings, and Plist Analyzer auto-resolve a `.app` bundle's main executable (via `CFBundleExecutable`, falling back to the sole binary in `Contents/MacOS/`) — point them at the bundle directly. Run those four together against a bundle or binary with `./mac_stack.sh`. More Mac-specific detections are planned for upcoming releases.\n\n*Threat Intel Query supports optional API keys for VirusTotal, MalwareBazaar, OTX, and additional sources. Sources without configured keys are skipped automatically.*\n\n---\n\n

Dependencies:

\n\nLinux\n```\nsudo apt install openssl libssl-dev clang yara libyara-dev libjansson-dev pkg-config build-essential libglib2.0-dev libgtk-3-dev\n```\n\nMac\n```\nbrew install openssl yara pkg-config gtk+3 glib\n```\nNote: YARA 4.2> required.\nBefore building, point the build to to Homebrew's YARA prefix\n```\nexport YARA_LIBRARY_PATH=$(brew --prefix yara)/lib\nexport BINDGEN_EXTRA_CLANG_ARGS=\"-I$(brew --prefix yara)/include\"\n```\n\n---\n\n

Installation & Usage:

\n\nInstall Rust — https://rustup.rs/\n\nFor CLI only installations (WSL, Raspberry Pi, etc.):\n\n```\ncurl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh\n```\n\nClone the repository and build:\n\n```\ngit clone https://github.com/dwmetz/MalChela.git\ncd MalChela\nchmod +x release.sh\n./release.sh # Builds all programs in release mode (recommended)\n```\n\nIf you cloned MalChela before 17-Apr-2026, you may see a diverging branches error when pulling. Run `git fetch origin && git reset --hard origin/main` to resync. This was a one-time history rewrite to remove a large file.\n\n

Run:

\n\n#### PWA (recommended):\n\nOn first run, execute the setup script after building the binaries:\n\n```\ncd server\n./setup-server.sh\n```\n\nThen start the server:\n\n```\n./start-server.sh\n```\n\nThe PWA will be accessible from any browser on the local network.\n\n#### CLI:\n\n```\n./target/release/malchela\n```\n\nThe CLI is retained for scripting and automation use cases.\n\n\nℹ️ It is recommended to build and run MalChela in `--release` mode to ensure GUI and subtools function optimally.\n\n> ⚠️ **Important:** MalChela binaries must be invoked from the project root directory. Always use `cd /path/to/MalChela && ./target/release/` rather than calling the binary directly from another path. This is required for correct resolution of API key files (`vt-api.txt`, `mb-api.txt`), YARA rules, and Sigma rules — all of which are resolved relative to the project root. API keys are read exclusively from these files; environment variables are not supported.\n\n---\n\n### Case Management\n\nMalChela includes a full-featured case system:\n\n- Cases no longer require starting with a file or folder — any tool result can be saved to a case\n- Create a new case from within a running tool session\n- Output saved under saved_output/cases//\n- Integrated tagging, search, and status (open/closed)\n- Seamless case loading and archiving\n\n\n---\n\n### 🔍 Analyze — One-Click Auto-Triage *(v4.2)*\n\nPoint Analyze at a file, folder, or `.app` bundle and it classifies everything with File Miner, then automatically dispatches every tool File Miner suggests for each file it finds — no need to read the suggestions and run each tool by hand.\n\n- Available in both the PWA and as an `analyze` tool in the MCP server, so AI agents can run the same triage workflow directly.\n- **Save to Case** is opt-in, matching every other tool panel's checkbox-and-dropdown pattern.\n- **Concise Output** (on by default) renders the rollup inline instead of the full expanded per-tool output.\n- Every run produces a `malchela_summary_.md` rollup report, saved alongside the individual tool reports it summarizes. It leads with a Triage Summary banner: file counts (with automatic duplicate-content grouping by SHA256), flagged-malicious verdicts cross-referenced from FileAnalyzer and Threat Intel Query, malware family/tag names, MITRE ATT&CK findings by tactic, filesystem/network IOCs, and structural flags/indicators from the Mac Analysis tools.\n\n---\n\n### 🤖 AI Integration & MCP Support\n\nMalChela exposes its full tool suite — including Analyze and the Mac Analysis stack — to AI agents like Claude through the **Model Context Protocol (MCP)**.\n\nSee [`.claude-plugin/mcp/README.md`](.claude-plugin/mcp/README.md) for setup: installing via the Claude Code plugin marketplace, running on a remote Kali/Raspberry Pi host, and API key configuration. For agentic coding environments (OpenCode and similar), MalChela ships [`AGENTS.md`](.claude-plugin/mcp/AGENTS.md), describing available tools and usage patterns for autonomous discovery.\n\nFor a detailed walkthrough of AI-assisted analysis approaches, see the blog post: [**MalChela Meets AI: Three Paths to Smarter Malware Analysis**](https://bakerstreetforensics.com)\n\n---\n\n

🔧 Adding Custom Tools:

\n\nYou can extend MalChela by editing the `tools.yaml` file to add third-party or custom tools to the GUI. This flexible configuration supports binaries, Python scripts, and Rust-based programs.\n\nEach entry defines the tool's name, category, execution type, how input is passed (file, folder, or hash), and any optional arguments. Here are a few sample entries:\n\n```yaml\n- name: capa\n description: \"Detects capabilities in binaries via rules\"\n command: [\"capa\"]\n input_type: \"file\"\n category: \"File Analysis\"\n exec_type: binary\n file_position: \"last\"\n optional_args: []\n\n- name: strings\n description: \"Extracts printable strings from binaries\"\n command: [\"strings\"]\n input_type: \"file\"\n category: \"Utilities\"\n exec_type: binary\n file_position: \"first\"\n optional_args: []\n\n- name: pdf-parser\n description: \"Parses and analyzes suspicious PDF structures\"\n command: [\"python3\"]\n input_type: \"file\"\n category: \"PDF Analysis\"\n exec_type: script\n file_position: \"last\"\n optional_args: [\"tools/pdf-parser/pdf-parser.py\"]\n```\n---\n

🦀 **REMnux Mode:**

\n\n\nWhen run on a REMnux system, MalChela can load a REMnux-specific `tools.yaml` file tailored for the built-in tools available in that distro. This ensures smoother setup with minimal configuration required.\n\n📝 **Notes:**\n- Tools must be in your system `PATH` or include a full/relative path.\n- `exec_type` must be one of: `cargo`, `binary`, or `script`.\n- `file_position` indicates where the input is placed in the command (`first` or `last`).\n- See the [MalChela User Guide](https://dwmetz.github.io/MalChela/) for detailed configuration examples and workflows.\n\n---\n\n

Enhanced Tool Support:

\n\nMalChela includes improved integration with the following third-party tools:\n\n- **Volatility 3**: Dynamic plugin builder, argument templating, and output directory selection.\n- **TShark**: Visual reference panel and support for capturing filtered traffic with custom syntax.\n- **YARA-X**: Smart rule matching with improved argument handling and REMnux-compatible default configuration.\n\nThese enhancements make working with memory images, PCAPs, and YARA rules more streamlined for forensic workflows.\n\n---\n\n#### Platform Support:\n\nSuccessfully tested on macOS (Apple Silicon), Ubuntu, and Raspberry Pi. \n\nYARA version 4.2 or greater is required.\n\n**Windows:** As of October 2025, both MalChela CLI and GUI operate on Windows under WSL2. MalChelaGUI improvements for WSL included in v3.1.1.\n\n", "bytes": 11178, "sha": "84d96737cc898d1cbb4e2fe2cd98ab76a632da494c1fc070ed410f1646952141", "repo_slug": "dwmetz/malchela", "fonte": "repo", "truncated": false, "api": "https://agentalog.com/api/listings/plg_dwmetz_malchela_malchela_f24509ad/readme" }