Unpacking ATT&CK With MalChela v4.4

DFIR, Mac, Malware, MITRE ATT&CK, open-source, REMnux, Rust, SIgma, Triage, yara

I came home from ATT&CKcon with a full notebook and a head full of technique IDs. So, fair warning: this release is on a bit of a MITRE kick. But it’s not the only thing in here. v4.4 has three headliners: a brand-new unpacker, ATT&CK mapping across the whole toolkit, and a move to YARA-X that makes installing MalChela a lot less painful.

Unpack

This one came straight out of conversations at the conference.

@dwmetz How can I extract the details strings from packed malware sample. Can Malchela support malware unpacked feature?

Up to now the honest answer was “go get another tool.” Not anymore.

Unpack detects packers, installers, and bundlers in PE, ELF, and Mach-O files and pulls out the payload statically. It never runs the sample. Every call it makes comes with the evidence behind it, and anything it recovers goes right back through Unpack again, so a dropper inside an installer inside a UPX stub comes out as a layer tree instead of just the outer shell.

  • UPX, including the mangled headers Mirai and friends use to make upx -d give up. Unpack repairs a working copy and records every byte it touched.
  • PyInstaller, and then it keeps going into the Python bytecode itself (3.7 through 3.14), peeling off the obfuscation wrappers stealers love: xz, zlib, base64, rot13, the works. The strings land in mStrings automatically.
  • .NET / Costura resources, NSIS, Inno Setup, fat Mach-O, overlays, and executables embedded in other executables.

Point Analyze at a packed sample and Unpack kicks in on its own. Everything it recovers gets the full MalChela treatment. Running a LunaGrabber build through it was a good test: an obfuscated entry script three layers deep, and out came the Discord webhook it exfiltrates to.

MITRE All the Things

Between Unpack, the Mac tools, File Miner, and Analyze, a single run can turn up ATT&CK findings from a dozen files and half a dozen tools. Reading those as a list gets old fast. So now every Analyze run plots them on the Enterprise matrix.

  • Tiles are shaded by how many files hit them. Click one and you get the evidence: which rule, which tool, which file, and the strings that matched.
  • Open the matrix for any saved case, and it pulls in every Analyze run and every standalone tool report in that case. Older cases work too.
  • Every run also saves an ATT&CK Navigator layer, so you can take it straight into Navigator.
  • Everything is on ATT&CK v20: Stealth and Defense Impairment instead of the retired Defense Evasion, and revoked techniques remapped.
  • Click a technique ID in mStrings and the built-in MITRE Lookup opens right there. (Cmd/Ctrl-click still takes you to attack.mitre.org.)

YARA-X

If you’ve ever installed MalChela on a Mac, you know the dance: brew install yara, then export YARA_LIBRARY_PATH, then BINDGEN_EXTRA_CLANG_ARGS, then hope. That’s all gone. Every MalChela tool now runs on YARA-X, VirusTotal’s Rust rewrite of YARA, compiled right in. No libyara, no bindgen, no OpenSSL. On Linux the prerequisites are now build-essential and pkg-config. On a Mac it’s the Xcode command line tools.

It also clears the biggest roadblock to running MalChela natively on Windows. WSL2 is still the supported route for now, but native Windows testing is next on my list.

A huge thank-you to Daniel Iwugo (@elementmerc), who did the groundwork on the new YARA backend and closed the gaps between it and libyara. This is what open source is supposed to look like.

YARA Scan

With the engine built in, it would have been silly not to expose it. YARA Scan is a new tool for running your own rules against a file or folder, and it speaks the same language as VirusTotal’s yr scan: same flags, same output. I tested it side by side with yr on the full signature-base rule set and got identical results. It saves reports to your case, and there’s a simplified panel in the web interface. For the deeper yr features like compiled rules and module data, the YARA-X integration is still there.

IP Reputation and GreyNoise

Threat Intel Query now looks up IP addresses on VirusTotal, AlienVault OTX, and, new in this release, GreyNoise. There’s a new IP tab, and defanged input is fine. The part I like best: an IP being “found” doesn’t mean much on its own, since 8.8.8.8 is in every source there is. So instead of FOUND, each source tells you what it actually concluded: flagged, clean, a known benign service, or a scanner. Analyze runs the same lookups on the IPs it finds.

mStrings got smarter about IPs too. When dozens of addresses are stored together, like a sandbox blocklist or a C2 pool, they’re reported as one list instead of fifty separate “C2” hits.

Odds and Ends

  • The Analyze summary now follows the structure of Lenny Zeltser’s Malware Analysis Report template, and the template is built into the MCP plugin, so Claude can write the full report and save it to your case.
  • mStrings recognizes encoded string tables. AMOS keeps its whole AppleScript as about 1,900 encoded strings; now you get one clear finding instead of a wall of matches.
  • The API Keys panel has a slot for GreyNoise, and At a Glance counts all 21 tools.
  • The docs and the PDF user guide are up to date, with new pages for Unpack and YARA Scan.
Grab the latest MalChela release
Read the Docs

From Strings to Techniques: Catch Me at ATT&CKcon 7.0

DFIR, Malware, MITRE ATT&CK, Presentations, SIgma

I’m excited to share that I’ll be speaking at MITRE ATT&CKcon 7.0, October 27–28, 2026, at MITRE in McLean, VA and online.

My talk, From Strings to Techniques: AI-Augmented Malware Analysis with MalChela and Claude Desktop, looks at what happens when you give an AI co-analyst real tools instead of just a chat window. Using MalChela’s MCP server integration with Claude Desktop, I’ll walk through a workflow that goes from raw string extraction to ATT&CK-mapped findings, synthesizes results across multiple tools, and ends with something defenders can actually use: detection content.

Expect a practical look at:

  • ATT&CK-mapped string analysis with mStrings, turning noise into techniques
  • Cross-tool synthesis, letting the co-analyst correlate output from tiquery, fileanalyzer, and more
  • Closing the loop, from static analysis to YARA and Sigma rules ready for detection engineering

If you’re going to be in McLean, come say hello. I’m always up for talking DFIR, malware, open-source tooling, or where AI fits (and doesn’t) in our workflows. If you can’t make the trip, ATT&CKcon offers virtual attendance, so you can still catch the talk and the rest of a great lineup.

Register for ATT&CKcon 7.0

If you’d like to get a head start, MalChela is available on GitHub. See you there!

A Non-DFIR Post: Come Have a Drink at 221B.bar

Not-DFIR

Some of you found your way to Baker Street Forensics because you’re Sherlockians first, and forensicators second. An unfathomable number of you showed up just for the ‘Lack Rack’. And the rest of you, my trusted readers as King would say, are probably wondering what any of this has to do with disk images and timelines.

Nothing. That’s the point.

I think everyone who’s worked in DFIR long enough has entertained some version of the same fantasy: going completely off-grid with a a well-stocked library, pantry, and bar – with nothing to do with technology except a bank of solar panels. I’ve certainly spent my share of incident-response nights thinking about it.

But there’s a second fantasy that’s been living rent-free right alongside it: retiring someday and opening a Sherlock-themed bar. Until that day arrives, or a wealthy patron steps forward to fund it, the 221B Bar exists online.

221b.bar is a growing compendium of Sherlockian cocktails, drinks named after cases, characters, and canon riffs, with a proper Baker Street atmosphere to match. A bit of a hobby, a bit of a pipe 💨 dream, but I’d love for you to visit.

The menu has a search function, and a “What’s in your Bar” option, so you can select the spirits you already have on hand, and it will show you which cases, and which recipes, you’re able to build – or if you’re just an ingredient or two shy.

There’s also a corner reserved in homage to the dwindling number of Pipe smokers, and those whose memories can be sparked by an aroma.

Stop by and have a drink with us. Aspiring mixologists are welcome to participate.

MalChela v4.3

DFIR, Mac, Malware, MITRE ATT&CK, open-source, REMnux, Rust, SIgma, Triage

Hot on the heels of v4.2… yep, v4.3. What can I say? The melatonin isn’t cutting it anymore to keep me asleep. Rather than count sheep – working on my favorite project helps. Granted I’ve still got bags under my eyes, but I’ve got something to show for it.

At A Glance

The first thing you’ll notice on this release, after all it’s impossible to miss, the At A Glance panel added to the Home Screen. In addition to the “Crabby Koans“, you see:

  • Number of open/closed cases
  • API key status
  • Number of MalChela tools loaded
  • Number of Integrations (3rd party tools) loaded; great for REMnux mode
  • GitHub status for available updates (it’s back!)

Other UI enhancements include new Analyze and Cases toolbar buttons, a collapsible Tools sidebar; and live progress updates during a run.

Airplane Mode / Offline Mode

While there’s a lot of great threat-intel information you can garner using TIQuery and the other utilities, sometimes internet isn’t an option – or maybe it’s a sample you want to handle so carefully you want to ensure there’s no external lookup activity. MalChela won’t mess with your Op-Sec. Rather than just have things fail gracefully (hopefully) when there’s no internet, there’s now a new Offline Mode toggle (Configuration screen), that cleanly skips every network call across the toolkit (NSRLQuery, TIQuery’s full multi-source lookup, FileAnalyzer’s VirusTotal + NSRL checks) instead of failing quietly or hanging, so labs and scenarios can run fully air-gapped.

Analyze Rollup

  • Triage Summary now links directly to the relevant section for flagged malicious files and their flags/indicators, plus the Filesystem and Network IOC lists — click a finding, jump straight to the detail.
  • Network IOCs in the rollup are shown defanged by default, with a note clarifying that links jump to the report section rather than the live URL.
  • Case ZIP/archive samples and containers found mid-scan (not just top-level) are now auto-extracted and analyzed automatically.
  • Includes the new dpp Extract tool: unwraps DMG/PKG containers to reach the real payload files inside.

mStrings

As the tools and the suite continue to grow, mStrings remains the star of the show. Updates in this release include:

  • Network IOCs in mStrings’ own report output are now defanged, matching the rollup.
  • Base64 strings are now auto-decoded and recursively rescanned for further IOCs/detections.
  • Regex engine switched to fancy-regex, enabling lookaround-based detection patterns.
  • Better surfacing of bare-domain C2 IOCs and multi-layer obfuscation depth.

The Base64 scanning is impressive. On one of my test samples MalChela was able to extract strings in a file buried under 8 layers of Base64 encapsulation.

StringsToYARA

  • New refang capability: defanged URLs (hxxp://, [.]) in source strings are automatically restored to real URLs in the generated YARA rule.

Safely store your URLs in a defanged state – when it’s time to create the rule – then and only then does the live url get exposed.

Detections

  • 25 new detection rules added (bringing the ruleset to 144), including full coverage for the Proton macOS RAT family, XCSSET, iWorm, EmPyre, Bella RAT, BirdMiner, and Python self-decompressing execution patterns.

Documentation

  • Full documentation pass covering all of the above, plus a new Offline Mode reference page and a Top Toolbar quick-reference table.
  • Bonus for me, the PDF User Guide is now generated via an automated, versioned build pipeline.
Grab the latest MalChela release
Read the Docs