A Feature Rich Modular Malware Configuration Extraction Utility for MalDuck

Last update: Dec 18, 2022

Related tags

Security related resources mwcfg

Overview

Malware Configuration Extractor

A Malware Configuration Extraction Tool and Modules for MalDuck

This project is FREE as in FREE 🍺 , use it commercially, privately or however you see fit.

The easiest way to use this project is to visit mwcfg.info, and start extracting malware config right away!

If you like this project and wish to donate 💰 to support the fight against malware...

Buy me a 🍵 , as I don't drink 🍺 , by sending me some ₿ to 16oXesi7uv3jdPZxxwarHSD2f3cNMpaih9

Installation:

sudo apt install -y python-virtualenv python-is-python3 git-lfs
git clone --recursive https://github.com/c3rb3ru5d3d53c/mwcfg.git
cd mwcfg/
virtualenv venv/
source venv/bin/activate
./setup.py install
git lfs --include tests/azorult.zip
unzip -P infected tests/azorult.zip tests/
mwcfg --input tests/azorult/ --modules modules/ --threads 4 --debug
mwcfg --input tests/azorult/ --list-modules

Installation with PyPi:

sudo apt install -y python-virtualenv python-is-python3
virtualenv venv/
source venv/bin/activate
pip install mwcfg
git clone https://github.com/c3rb3ru5d3d53c/mwcfg-modules.git modules/
mwcfg --input sample.bin --modules modules/ --debug

Server Installation with Docker:

sudo apt install -y docker.io make
sudo usermod -a -G docker $USER
make mwcfg-server        # Build Server
make mwcfg-server-start  # Start the Server
make mwcfg-server-status # Check Running Status
make mwcfg-server-logs   # Tail Logs
make mwcfg-server-stop   # Stop Server
make mwcfg-server-clean  # Delete Server

Once completed, navigate to https://127.0.0.1

You can alternatively upload samples and get results by doing:

curl --silent --insecure -X POST --upload-file sample.bin https://127.0.0.1

mwcfg Usage:

usage: mwcfg v1.0.0 [-h] [--version] [-i INPUT] -m MODULES [--list-modules] [-d] [-p] [-t THREADS] [-r] [-l LOG]

A Modular Malware Configuration Extraction Utility for MalDuck

optional arguments:
  -h, --help            show this help message and exit
  --version             show program's version number and exit
  -i INPUT, --input INPUT
                        Input File or Directory
  -m MODULES, --modules MODULES
                        Modules
  --list-modules
  -d, --debug           Debug
  -p, --pretty          Pretty Print Configs
  -t THREADS, --threads THREADS
                        Threads
  -r, --recursive       Recursive
  -l LOG, --log LOG     Log to File

Author: c3rb3ru5

mwcfg-server Usage:

usage: mwcfg-server v1.0.0 [-h] [--version] [--host HOST] [-p PORT] -m MODULES [-u UPLOADS] [-d]

A Modular Malware Configuration Extraction Server using MalDuck

optional arguments:
  -h, --help            show this help message and exit
  --version             show program's version number and exit
  --host HOST           Host
  -p PORT, --port PORT
  -m MODULES, --modules MODULES
                        Modules
  -u UPLOADS, --uploads UPLOADS
                        Uploads Directory
  -d, --debug

Author: c3rb3ru5

Karton Framework Installation:

sudo apt install -y python-virtualenv python-is-python3 git-lfs
git clone --recursive https://github.com/c3rb3ru5d3d53c/mwcfg.git
cd mwcfg/
virtualenv venv/
source venv/bin/activate
./setup.py install
pip install karton-config-extractor
karton-config-extractor --config-file karton.ini --modules modules/

Contributing Modules:

Please refer to CONTRIBUTING.md

Additional Resources:

Comments

Update requirements.txt to use updated version of the crypto library

The pycryto library used in the requirements.txt file has been deprecated for about 9 years and contains security vulnerabilites. Pycrytodome is up to date and should be a drop in replacement from what I've seen it used for the code.

opened by cccs-sgaron 0

A guide to building basic malware in Python by implementing a keylogger application

Keylogger-Malware-Project A guide to building basic malware in Python by implementing a keylogger application. If you want even more detail on the Pro

1 Jan 11, 2022

A malware to encrypt all the .txt and .jpg files in target computer using RSA algorithms

A malware to encrypt all the .txt and .jpg files in target computer using RSA algorithms. Change the Blackgound image of targets' computer. and decrypt the targets' encrypted files in our own computer

2 Dec 2, 2022

Detection tool of malware(s) by checksum (useful for forensic)

🐍 malware_checker.py Detection tool of malware(s) by checksum (useful for forensic) 📦 Dependencies installation $ pip3 install -r requirements.txt

1 Jan 30, 2022

Huskee: Malware made in Python for Educational purposes

𝐇𝐔𝐒𝐊𝐄𝐄 Caracteristicas: Discord Token Grabber Wifi Passwords Grabber Googl

4 Aug 17, 2022

Cobalt Strike Beacon configuration extractor and parser.

Cobalt Strike Configuration Extractor and Parser Overview Pure Python library and set of scripts to extract and parse configurations (configs) from Co

102 Dec 18, 2022

An interactive python script that enables root access on the T-Mobile (Wingtech) TMOHS1, as well as providing several useful utilites to change the configuration of the device.

TMOHS1 Root Utility Description An interactive python script that enables root access on the T-Mobile (Wingtech) TMOHS1, as well as providing several

40 Dec 29, 2022

Hubble is a modular, open-source security compliance framework. The project provides on-demand profile-based auditing, real-time security event notifications, alerting, and reporting. HubbleStack is a free and open source project made possible by Adobe. https://github.com/adobe

Welcome to HubbleStack!! You can find the docs here You can file an issue here Follow us on Twitter! Development Below are sample instructions to setu

368 Jan 4, 2023

Dependency Combobulator is an Open-Source, modular and extensible framework to detect and prevent dependency confusion leakage and potential attacks.

Dependency Combobulator Dependency Combobulator is an Open-Source, modular and extensible framework to detect and prevent dependency confusion leakage

84 Dec 23, 2022

Source code for "A Two-Stream AMR-enhanced Model for Document-level Event Argument Extraction" @ NAACL 2022

TSAR Source code for NAACL 2022 paper: A Two-Stream AMR-enhanced Model for Document-level Event Argument Extraction. 🔥 Introduction We focus on extra

21 Sep 24, 2022

A Feature Rich Modular Malware Configuration Extraction Utility for MalDuck

Related tags

Overview

Malware Configuration Extractor

You might also like...

A guide to building basic malware in Python by implementing a keylogger application

A malware to encrypt all the .txt and .jpg files in target computer using RSA algorithms

Detection tool of malware(s) by checksum (useful for forensic)

Huskee: Malware made in Python for Educational purposes

Cobalt Strike Beacon configuration extractor and parser.

An interactive python script that enables root access on the T-Mobile (Wingtech) TMOHS1, as well as providing several useful utilites to change the configuration of the device.

Hubble is a modular, open-source security compliance framework. The project provides on-demand profile-based auditing, real-time security event notifications, alerting, and reporting. HubbleStack is a free and open source project made possible by Adobe. https://github.com/adobe

Dependency Combobulator is an Open-Source, modular and extensible framework to detect and prevent dependency confusion leakage and potential attacks.

Source code for "A Two-Stream AMR-enhanced Model for Document-level Event Argument Extraction" @ NAACL 2022

Comments

Update requirements.txt to use updated version of the crypto library

Releases(v1.0.1)

v1.0.1(May 1, 2021)

v1.0.0(May 1, 2021)

Owner

c3rb3ru5

DoSer.py - Simple DoSer in Python

NExfil is an OSINT tool written in python for finding profiles by username.

ProxyLogon Full Exploit Chain PoC (CVE-2021–26855, CVE-2021–26857, CVE-2021–26858, CVE-2021–27065)

USSR-Scanner - USSR Scanner with python

Natural Language Processing - Sommer Semester 2022

Directory Traversal in Afterlogic webmail aurora and pro

Check for breached passwords with k-anonymity

Log4j-Scanner with Bind-Receipt and custom hostnames

Python exploit code for CVE-2021-4034 (pwnkit)

A security system to warn you when people enter your room 🎥

集成crawlergo、xray、dirsearch、nmap等工具的src漏洞挖掘工具，使用docker封装运行；

Crowbar - A windows post exploitation tool

MozDef: Mozilla Enterprise Defense Platform

Searches for potentially vulnerable websites to local file inclusion, throughout the web and then exploits them for LFI

This exploit allows to connect to the remote RemoteMouse 3.008 service to virtually press arbitrary keys and execute code on the machine.

Password list generator for password spraying - prebaked with goodies

This python script will automate the testing for the Log4J vulnerability for HTTP and HTTPS connections.

High level cheatsheet that was designed to make checks on the OSCP more manageable

This script allows you to make a onion host instantly.

S2-061 的payload，以及对应简单的PoC/Exp